CVE-2026-71299

A flaw was found in Maestro. Its REST API write endpoints were registered without proper authentication middleware. This allows a remote attacker to perform unauthorized write operations, such as creating, modifying, or deleting consumers and resource bundles. This could lead to data integrity issues or a denial of service (DoS).

• CWE-306

• https://access.redhat.com/security/cve/CVE-2026-71299
• https://bugzilla.redhat.com/show_bug.cgi?id=2511520

Published

Oct 5, 2026

Last Modified

Oct 7, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-71291Bolt CMS renders content field values through Twig's full ap…8.8
• CVE-2026-71292Subrion CMS's admin grid sorting helper, _gridGetSorting in …7.2
• CVE-2026-71293Statamic CMS's user-augmentation resolver, AugmentedUser::ge…6.2
• CVE-2026-71294Cotonti CMS's Comments plugin deserializes user-supplied dat…7.6
• CVE-2026-71297A flaw was found in the maestro gRPC broker. This vulnerabil…5.4
• CVE-2026-71298A flaw was found in maestro. A remote attacker could exploit…6.4
• CVE-2026-7130A flaw has been found in SourceCodester Pharmacy Sales and I…7.3
• CVE-2026-71300Improper input validation vulnerability in Apache Camel Atmo…9.8
• CVE-2026-71301Gitea's repository markup endpoint resolves same-repository …4.3
• CVE-2026-71302The application accepts user-supplied session identifiers an…7.1
• CVE-2026-71303Lemur manages TLS certificate creation. Prior to 1.9.3, _val…7.7
• CVE-2026-71307Lemur manages TLS certificate creation. Prior to 1.9.3, GET …7.7