The orderBy query parameter in maestro's REST API list endpoints flows unsanitized into gorm.Order() at pkg/dao/generic.go:64. NewListArguments reads r.URL.Query() raw, cleanOrderBy/getField apply only literal-byte splits with an empty denylist (SearchDisallowedFields), and the result is passed unparameterized to gorm .Order(). The lexical filters (no literal comma, max 1 space, max 1 dot) are bypassable via TAB (%09), LF, or /**/ whitespace substitution and comma-free Postgres syntax.

The REST API has no authentication middleware, so the injection is reachable without credentials (PR:N). Impact is constrained to read-only blind ORDER BY extraction -- the properties.* half of the originally reported claim (sql_helpers.go:83) is largely mitigated by treeWalkForRelatedTables rejecting 'properties.x' before propertiesNodeConverter is reached.

Upstream repo: https://github.com/openshift-online/maestro
Jira: ACM-38753