CVE-2026-71297 — Maestro: maestro: grpc broker has no auth interceptor and client mtls is optional
A flaw was found in the maestro gRPC broker. This vulnerability allows a remote attacker, with a valid client certificate, to bypass authentication. This bypass enables the atta…
Published: 2026-10-05 · CVSS: 5.4 · CVSS 3.1
A flaw was found in the maestro gRPC broker. This vulnerability allows a remote attacker, with a valid client certificate, to bypass authentication. This bypass enables the attacker to subscribe to other consumers' event streams, leading to unauthorized information disclosure, or to publish forged agent status, which can compromise data integrity.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7