Maestro EUVD-2026-92758

Exploitation requires network reachability to the Maestro REST API's write endpoints, which were registered without authentication middleware - meaning no credentials, token, or session are needed against an affected deployment. The practical limiting factor is network exposure: if the Maestro API is only reachable from within the cluster (bound to internal services, gated by Kubernetes NetworkPolicy, or placed behind an authenticating gateway/service mesh), external unauthenticated attackers cannot reach it. There is no required user interaction and no non-default feature toggle implied by the description; the flaw exists in the endpoint registration itself. Impact is scoped to the consumer and resource-bundle write operations exposed by those endpoints.

This is a genuine, remotely exploitable authentication weakness (CWE-306, Missing Authentication for a Critical Function) in Maestro, a messaging/resourcing component shipped with Red Hat's Multicluster Engine for Kubernetes. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms network-reachable, low-complexity, unauthenticated exploitation requiring no user interaction - the most favorable possible preconditions for an attacker, which is why the issue is credible rather than theoretical. However, the real-world risk is moderated by several factors: no EPSS score was provided, the CVE is NOT listed in CISA KEV, and no public proof-of-concept is referenced, so there is no evidence of active exploitation or weaponization. The NVD/Red Hat impact scoring is relatively modest (C:L/I:L/A:N, base 6.5) which appears to understate the described consequences - unauthenticated create/modify/delete of consumers and resource bundles is primarily an integrity and availability concern, yet the official vector marks A:N despite the description explicitly citing DoS. This is a conflict worth noting: the description implies an availability impact (DoS) that the supplied CVSS vector does not reflect. Net assessment: a real, patch-worthy flaw whose practical risk depends heavily on network exposure of the Maestro REST API - critical if the API is reachable from untrusted networks, substantially lower if it sits behind cluster-internal network policy or a service mesh, which is the typical deployment posture.

An attacker with network reachability to the Maestro REST API sends write requests directly to endpoints that were registered without authentication middleware, bypassing any login or token requirement. They create, alter, or delete consumer and resource-bundle objects to corrupt the multicluster management state or overwhelm/disrupt the service, causing data-integrity damage or denial of service. No public exploit code is referenced, so exploitation would currently require an attacker to craft requests from the published endpoint behavior.