Bug 2511520 (CVE-2026-71299)
| Summary: | CVE-2026-71299 maestro: maestro: REST API write endpoints registered without authentication middleware | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | crizzo, gparvin, jbalunas, rhaigner, security-response-team, tsze |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in Maestro. Its REST API write endpoints were registered without proper authentication middleware. This allows a remote attacker to perform unauthorized write operations, such as creating, modifying, or deleting consumers and resource bundles. This could lead to data integrity issues or a denial of service (DoS).
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
routes.go registers POST/PATCH/DELETE on /api/maestro/v1/consumers and DELETE on /api/maestro/v1/resource-bundles/{id}. The middleware chain (NewAPIServer/registerApiMiddleware) applies only Metrics, Transaction, Compress, CORS, removeTrailingSlash, and otelhttp -- no JWT, TokenReview, or mTLS in the HTTP chain. The gRPC path has auth interceptors but the REST path does not, suggesting an asymmetric omission rather than deliberate delegation. The Helm chart ships no Istio AuthorizationPolicy, NetworkPolicy, or oauth-proxy, so authentication is entirely dependent on the deployment environment. With route.enabled=true (chart default), an OpenShift Route exposes unauthenticated write endpoints. Maestro is a Tech Preview component in ACM. The TP status and expectation that users provide their own authentication layer are not documented in customer-facing materials. Upstream repo: https://github.com/openshift-online/maestro Jira: ACM-38752