CVE-2026-71298
Red Hat Multicluster Engine for Kubernetes
Published 5 Oct 2026 · updated 5 Oct 2026 · Received
6.4 Medium · CVSS 3.1, redhat.com
Description
A flaw was found in maestro. A remote attacker could exploit a SQL injection vulnerability in the `orderBy` query parameter of its REST API list endpoints. This flaw, which does not require authentication, allows for read-only blind extraction of data from the database.