maestro gRPC Broker CVE-2026-71297

Exploitation requires the attacker to possess a valid client certificate accepted by the maestro gRPC broker - i.e. an already-provisioned mTLS client identity, not anonymous access. Given that certificate, no user interaction or additional configuration is needed (AC:L/UI:N) and the broker's authentication check can be bypassed to subscribe to other consumers' event streams or publish forged agent status. The principal limiting factor is the client-certificate prerequisite (PR:L), which restricts this to trusted-but-lower-privileged or compromised clients rather than arbitrary remote attackers; impact is confined to partial confidentiality and integrity within the broker (no availability impact, scope unchanged).

This is a moderate-severity authentication bypass (CVSS 5.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) in the maestro gRPC broker shipped with Red Hat Multicluster Engine for Kubernetes, classified as CWE-306 (Missing Authentication for a Critical Function). The network attack vector and low complexity raise theoretical exposure, but the PR:L requirement is decisive: the attacker must already hold a valid client certificate, meaning this is not an anonymous internet-facing flaw but a privilege/trust-boundary bypass available to an already-provisioned mTLS client. Impact is partial on both confidentiality and integrity (C:L/I:L, A:N) - reading other consumers' event streams and forging agent status, not full compromise. No EPSS score, CISA KEV listing, SSVC decision data, or public proof-of-concept was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the signals available are internally consistent (a genuine auth-bypass with constrained privilege and impact) rather than conflicting. Net: a legitimate issue worth patching, especially in multi-tenant cluster-management deployments, but it is a bounded insider/lateral-movement risk, not a high-urgency mass-exploitation threat.

An attacker who has obtained a valid client certificate for the maestro gRPC broker (for example a low-privileged or compromised tenant client) connects over the network and exploits the authentication bypass to subscribe to event streams belonging to other consumers, reading their messages, and/or publishes forged agent status messages to corrupt the integrity of cluster state. No proof-of-concept was provided in the input, so this scenario is inferred from the description and CVSS vector (AV:N/AC:L/PR:L).