Bug 2511518 (CVE-2026-71297) - CVE-2026-71297 maestro: maestro: gRPC broker has no auth interceptor and client mTLS is optional
Summary: CVE-2026-71297 maestro: maestro: gRPC broker has no auth interceptor and clie...
Keywords:
Status: NEW
Alias: CVE-2026-71297
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-08-05 13:23 UTC by OSIDB Bzimport
Modified: 2026-10-05 18:32 UTC (History)
6 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-08-05 13:23:02 UTC 
The gRPC broker in maestro (grpc_broker.go:130) constructs grpc.NewServer with no ChainUnaryInterceptor or ChainStreamInterceptor for authentication. Client certificate verification (tls.RequireAndVerifyClientCert) is applied only when BrokerClientCAFile is non-empty (default: empty string). Even with mTLS enabled, no per-agent AccessReview exists (unlike grpc_server.go), so any valid certificate can subscribe to other consumers' source events or publish forged agent status. The broker is activated when --message-broker-type=grpc is selected (one of three supported modes). Chart defaults: messageBroker.grpc.tls.enabled=false.

Maestro is a Tech Preview component in ACM. The TP status and expectation that users provide their own authentication layer are not documented in customer-facing materials.

Upstream repo: https://github.com/openshift-online/maestro
Jira: ACM-38754
Note You need to log in before you can comment on or make changes to this bug.