CVE-2026-71298: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Red Hat Multicluster Engine for Kubernetes

A SQL injection vulnerability exists in the `orderBy` query parameter of the REST API list endpoints in Red Hat Multicluster Engine for Kubernetes (maestro component). This flaw allows a remote attacker to inject SQL commands without authentication, enabling read-only blind extraction of database data. The vulnerability is classified as medium severity with CVSS 3.1 vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L. No known exploits in the wild have been reported. The vendor advisory is available but does not explicitly state patch or remediation status.

An unauthenticated remote attacker can exploit this vulnerability to perform blind SQL injection attacks, resulting in unauthorized read-only access to sensitive data stored in the database. The integrity impact is low, and availability impact is low, but confidentiality impact is high due to data exposure.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-71298 for current remediation guidance. Until an official fix is available, restrict access to the affected REST API endpoints and monitor for suspicious query parameter usage. Avoid exposing the vulnerable API to untrusted networks.