VDB

CVE-2026-9165

CVE-2026-9165 PUBLISHED CVSS 7.7 HIGH

Reported by redhat · Published July 6, 2026

A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). Central does not limit the depth of GraphQL queries served on the authenticated GraphQL API. An authenticated user with a valid API token can send deeply nested queries that cause excessive resource consumption in Central, resulting in a denial of service for the management plane.

Risk Scores

CVSS 3.1
7.7
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Affected Products

VendorProductVersions
Red HatRed Hat Advanced Cluster Security 4.91783357116
Red HatRed Hat Advanced Cluster Security for Kubernetes 4.101783357140
Red HatRed Hat Advanced Cluster Security for Kubernetes 4.111783352589
Red HatRed Hat Advanced Cluster Security 4
Red HatRed Hat Advanced Cluster Security 4
Red HatRed Hat Advanced Cluster Security for Kubernetes 4.91783357116, 1783357116, 1783357116
Red HatRed Hat Advanced Cluster Security for Kubernetes 4.111783352589, 1783352589, 1783352589
Red HatRed Hat Advanced Cluster Security 4
Red HatRed Hat Advanced Cluster Security 4.91783357116, 1783357116, 1783357116
Red HatRed Hat Advanced Cluster Security for Kubernetes 4.101783357140, 1783357140, 1783357140

Timeline

  • Jul 6, 2026 CVE Published
  • Jul 7, 2026 EPSS Score
  • Jul 7, 2026 Coalition ESS Score
  • Aug 7, 2026 EPSS Score
  • Aug 24, 2026 EPSS Score
  • Aug 26, 2026 EPSS Score
  • Aug 30, 2026 EPSS Score
  • Sep 3, 2026 EPSS Score
  • Sep 5, 2026 EPSS Score
  • Sep 6, 2026 EPSS Score
  • Sep 8, 2026 CVE Updated
  • Sep 9, 2026 EPSS Score

References

Open in Interactive Console →
$ Console Community · 50/day Open console ›