Vulnerability Description
A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). Central does not limit the depth of GraphQL queries served on the authenticated GraphQL API. An authenticated user with a valid API token can send deeply nested queries that cause excessive resource consumption in Central, resulting in a denial of service for the management plane.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://access.redhat.com/errata/RHSA-2026:36207
- https://access.redhat.com/errata/RHSA-2026:36319
- https://access.redhat.com/errata/RHSA-2026:36625
- https://access.redhat.com/security/cve/CVE-2026-9165
- https://bugzilla.redhat.com/show_bug.cgi?id=2480505
FAQ
What is CVE-2026-9165?
CVE-2026-9165 is a vulnerability with a CVSS score of 7.7 (HIGH). A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). Central does not limit the depth of GraphQL queries served on the authenticated GraphQL API. An authenticated user with a ...
How severe is CVE-2026-9165?
CVE-2026-9165 has been rated HIGH with a CVSS base score of 7.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-9165?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.