CVE-2026-9165

Published: Jul 6, 2026Modified: Jul 7, 2026

7.7

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Exploitability: 3.1 / Impact: 4.0

Source: secalert@redhat.com (Secondary)

Description

A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). Central does not limit the depth of GraphQL queries served on the authenticated GraphQL API. An authenticated user with a valid API token can send deeply nested queries that cause excessive resource consumption in Central, resulting in a denial of service for the management plane.

Related CWEs

CWE-400

Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

References (2)

https://access.redhat.com/security/cve/CVE-2026-9165

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2480505

Source: secalert@redhat.com

Timeline

No history available yet.