Vulnetix
Try Vulnetix Request Demo
CVE-2026-3118 PUBLISHED CVSS 6.5 MEDIUM

A security flaw was identified in the Orchestrator Plugin of Red Hat Developer Hub (Backstage). The issue occurs due to insufficient input validation in GraphQL query handling. An authenticated user can inject specially crafted input into API requests, which disrupts backend query processing. This results in the entire Backstage application crashing and restarting, leading to a platform-wide Denial of Service (DoS). As a result, legitimate users temporarily lose access to the platform.

EPSS 0.01% · 2.4th percentile

Risk Scores

CVSS v3.1
6.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS Score
0.01%
2.4th percentile

Affected Products

VendorProductVersions
Red HatRed Hat Developer Hub
redhatdeveloper_hub

Timeline

References

Open in Interactive Console →