CVEvulnerability
CVE-2026-9165
7.7 HIGH
Official page ↗
- Status
- Awaiting Analysis
- Published
- 2026-07-06
- Last modified
- 2026-09-08
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.7 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
- Weaknesses
- CWE-400
Description
A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). Central does not limit the depth of GraphQL queries served on the authenticated GraphQL API. An authenticated user with a valid API token can send deeply nested queries that cause excessive resource consumption in Central, resulting in a denial of service for the management plane.
Related
Weakness · CWE (1)
- CWE-400 Uncontrolled Resource Consumption weakness
References
- https://access.redhat.com/errata/RHSA-2026:36207 access.redhat.com
- https://access.redhat.com/errata/RHSA-2026:36319 access.redhat.com
- https://access.redhat.com/errata/RHSA-2026:36625 access.redhat.com
- https://access.redhat.com/security/cve/CVE-2026-9165 access.redhat.com
- https://bugzilla.redhat.com/show_bug.cgi?id=2480505 bugzilla.redhat.com