{"id":"CVE-2026-71297","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-71297","generatedAt":"2026-10-28T06:35:09.041Z","title":"This vulnerability allows a remote attacker, with a valid client certificate, to bypass authentication.","description":"A flaw was found in the maestro gRPC broker. This vulnerability allows a remote attacker, with a valid client certificate, to bypass authentication. This bypass enables the attacker to subscribe to other consumers' event streams, leading to unauthorized information disclosure, or to publish forged agent status, which can compromise data integrity.","published":"2026-10-05T20:17:25.000Z","lastModified":"2026-10-06T15:17:19.000Z","status":"Awaiting Analysis","sourceIdentifier":"secalert@redhat.com","cvss":{"version":"3.1","score":5.4,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"},"cwe":["CWE-306"],"affected":[],"epss":{"score":0.00152,"percentile":0.04295,"date":"2026-10-27","history":[{"date":"2026-10-06","score":0.00152,"percentile":0.03762}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.15%). Track it; it rarely justifies an emergency change on its own."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-05T20:17:25.000Z","detail":{"score":"5.4","severity":"MEDIUM","publishedAt":"2026-10-05T20:17:25.103Z"},"summary":"New CVE, medium severity (CVSS 5.4)."}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-71297","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2511518","source":"secalert@redhat.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-71297","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}