Red Hat MCE EUVD-2026-92757

Exploitation requires network reachability to an MCE REST API 'list' endpoint and the ability to supply the orderBy query parameter, which is injected unsanitized into a backend SQL query. The vendor CVSS (PR:L) implies a low-privileged authenticated account may be needed to reach the endpoint, directly contradicting the description's claim that no authentication is required - defenders must confirm which is accurate, as it fundamentally changes exposure. Limiting factors: the injection is read-only (no data modification or destruction), extraction is blind and therefore slow/noisy due to the vendor's AC:H rating, and exposure depends on the MCE API being network-accessible to the attacker.

This is a medium-severity (CVSS 6.4) unauthenticated-or-low-privilege SQL injection (CWE-89) in the maestro component of Red Hat Multicluster Engine for Kubernetes, reported by Red Hat. There is a CRITICAL conflict in the source data: the description explicitly states the flaw 'does not require authentication,' yet the Red Hat CVSS vector specifies PR:L (low privileges required) - these contradict each other and must be verified with the vendor before prioritization. The network attack vector (AV:N) raises exposure, but the vendor-assigned AC:H (high attack complexity) tempers it, consistent with blind, inference-based SQL extraction that is time-consuming and may require many requests. Impact is dominated by confidentiality (C:H) from read-only database extraction, with only marginal integrity/availability impact (I:L/A:L) - the description confirms the injection is read-only, so the I/A ratings are likely conservative padding rather than real write or disruption capability. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or weaponization. Overall this is a genuine data-exposure concern for organizations running MCE, but absent exploitation signals and given AC:H plus the read-only nature, it ranks as a real but non-emergency patching priority rather than a drop-everything KEV-grade issue.

A remote attacker reaches an exposed MCE REST API list endpoint and supplies a crafted value in the orderBy query parameter, injecting SQL that is evaluated by the backend database. Using boolean/time-based blind inference the attacker extracts database contents row by row. No public exploit code was identified in the provided data, and the high attack complexity means extraction is slow and request-intensive.