Denial of Service Vulnerability in Red Hat Developer Hub's Orchestrator Plugin
CVE-2026-3118

6.5MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Developer Hub
Vendor
CVE Published:
25 February 2026

What is CVE-2026-3118?

A security flaw has been discovered within the Orchestrator Plugin of Red Hat Developer Hub, specifically linked to improper input validation in GraphQL query handling. This vulnerability enables an authenticated user to inject crafted input into API requests, consequently disrupting backend query processing. The resulting failure can crash the entire Backstage application, prompting a restart and leading to a platform-wide Denial of Service (DoS). This affects legitimate users by temporarily restricting their access to essential platform functionalities.

References

https://access.redhat.com/security/cve/CVE-2026-3118
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2442273
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Thibault Guittet for reporting this issue.
.