CVE-2026-71299: Missing Authentication for Critical Function in Red Hat Multicluster Engine for Kubernetes

The vulnerability CVE-2026-71299 affects Red Hat Multicluster Engine for Kubernetes. The Maestro component's REST API write endpoints were registered without proper authentication middleware, enabling remote attackers to execute unauthorized write operations. These operations include creating, modifying, or deleting consumers and resource bundles, which could compromise data integrity or cause denial of service. The CVSS 3.1 base score is 6.5 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, indicating network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and low confidentiality and integrity impacts with no availability impact. No explicit patch or remediation details are provided in the input data, but a vendor advisory URL is available for further reference.

Remote attackers can perform unauthorized write operations on the Maestro REST API endpoints, potentially leading to data integrity issues or denial of service. Confidentiality impact is low, integrity impact is low, and availability impact is none according to the CVSS vector.

Patch status is not yet confirmed — check the Red Hat vendor advisory at https://access.redhat.com/security/cve/CVE-2026-71299 for current remediation guidance. No explicit patch or workaround information is provided in the source data.