Bug 2511518 (CVE-2026-71297)

Summary:	CVE-2026-71297 maestro: maestro: gRPC broker has no auth interceptor and client mTLS is optional
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	crizzo, gparvin, jbalunas, rhaigner, security-response-team, tsze
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the maestro gRPC broker. This vulnerability allows a remote attacker, with a valid client certificate, to bypass authentication. This bypass enables the attacker to subscribe to other consumers' event streams, leading to unauthorized information disclosure, or to publish forged agent status, which can compromise data integrity.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-05 13:23:02 UTC

The gRPC broker in maestro (grpc_broker.go:130) constructs grpc.NewServer with no ChainUnaryInterceptor or ChainStreamInterceptor for authentication. Client certificate verification (tls.RequireAndVerifyClientCert) is applied only when BrokerClientCAFile is non-empty (default: empty string). Even with mTLS enabled, no per-agent AccessReview exists (unlike grpc_server.go), so any valid certificate can subscribe to other consumers' source events or publish forged agent status. The broker is activated when --message-broker-type=grpc is selected (one of three supported modes). Chart defaults: messageBroker.grpc.tls.enabled=false.

Maestro is a Tech Preview component in ACM. The TP status and expectation that users provide their own authentication layer are not documented in customer-facing materials.

Upstream repo: https://github.com/openshift-online/maestro
Jira: ACM-38754