Bug 2511519 (CVE-2026-71298)

Summary: CVE-2026-71298 maestro: SQL identifier injection via properties.* search filter and orderBy field
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: crizzo, gparvin, jbalunas, rhaigner, security-response-team, tsze
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in maestro. A remote attacker could exploit a SQL injection vulnerability in the `orderBy` query parameter of its REST API list endpoints. This flaw, which does not require authentication, allows for read-only blind extraction of data from the database.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-05 13:23:11 UTC 
The orderBy query parameter in maestro's REST API list endpoints flows unsanitized into gorm.Order() at pkg/dao/generic.go:64. NewListArguments reads r.URL.Query() raw, cleanOrderBy/getField apply only literal-byte splits with an empty denylist (SearchDisallowedFields), and the result is passed unparameterized to gorm .Order(). The lexical filters (no literal comma, max 1 space, max 1 dot) are bypassable via TAB (%09), LF, or /**/ whitespace substitution and comma-free Postgres syntax.

The REST API has no authentication middleware, so the injection is reachable without credentials (PR:N). Impact is constrained to read-only blind ORDER BY extraction -- the properties.* half of the originally reported claim (sql_helpers.go:83) is largely mitigated by treeWalkForRelatedTables rejecting 'properties.x' before propertiesNodeConverter is reached.

Upstream repo: https://github.com/openshift-online/maestro
Jira: ACM-38753