CVE-2026-71297: Missing Authentication for Critical Function in Red Hat Multicluster Engine for Kubernetes

The vulnerability in the maestro gRPC broker component of Red Hat Multicluster Engine for Kubernetes allows a remote attacker possessing a valid client certificate to bypass authentication controls. This bypass permits the attacker to subscribe to event streams intended for other consumers, causing unauthorized information disclosure. Additionally, the attacker can publish forged agent status messages, which may compromise the integrity of data within the system. The CVSS 3.1 score is 5.4, reflecting a medium severity with network attack vector, low attack complexity, required privileges, no user interaction, and impact on confidentiality and integrity but not availability.

An attacker with a valid client certificate can bypass authentication to access event streams of other consumers, leading to unauthorized disclosure of information. The attacker can also publish forged agent status messages, compromising data integrity. There is no indication of availability impact or active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-71297 for current remediation guidance. Until an official fix is available, restrict access to valid client certificates and monitor for unauthorized use. Follow vendor instructions once a patch or update is released.