CVE-2026-71298 — Maestro: sql identifier injection via properties.* search filter and orderby field
A flaw was found in maestro. A remote attacker could exploit a SQL injection vulnerability in the `orderBy` query parameter of its REST API list endpoints. This flaw, which does…
Published: 2026-10-05 · CVSS: 6.4 · CVSS 3.1
A flaw was found in maestro. A remote attacker could exploit a SQL injection vulnerability in the `orderBy` query parameter of its REST API list endpoints. This flaw, which does not require authentication, allows for read-only blind extraction of data from the database.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7