CVE-2026-71298

A flaw was found in maestro. A remote attacker could exploit a SQL injection vulnerability in the `orderBy` query parameter of its REST API list endpoints. This flaw, which does not require authentication, allows for read-only blind extraction of data from the database.

• CWE-89

• https://access.redhat.com/security/cve/CVE-2026-71298
• https://bugzilla.redhat.com/show_bug.cgi?id=2511519

Published

Oct 5, 2026

Last Modified

Oct 6, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-71290Improper TLS hostname verification vulnerability in Apache H…9.1
• CVE-2026-71291Bolt CMS renders content field values through Twig's full ap…8.8
• CVE-2026-71292Subrion CMS's admin grid sorting helper, _gridGetSorting in …7.2
• CVE-2026-71293Statamic CMS's user-augmentation resolver, AugmentedUser::ge…6.2
• CVE-2026-71294Cotonti CMS's Comments plugin deserializes user-supplied dat…7.6
• CVE-2026-71297A flaw was found in the maestro gRPC broker. This vulnerabil…5.4
• CVE-2026-71299A flaw was found in Maestro. Its REST API write endpoints we…6.5
• CVE-2026-7130A flaw has been found in SourceCodester Pharmacy Sales and I…7.3
• CVE-2026-71300Improper input validation vulnerability in Apache Camel Atmo…9.8
• CVE-2026-71301Gitea's repository markup endpoint resolves same-repository …4.3
• CVE-2026-71302The application accepts user-supplied session identifiers an…7.1
• CVE-2026-71303Lemur manages TLS certificate creation. Prior to 1.9.3, _val…7.7