Denial of Service Vulnerability in Red Hat Advanced Cluster Security for Kubernetes
CVE-2026-9165

7.7HIGH

Key Information:

Vendor

Red Hat
Status
Red Hat Advanced Cluster Security 4.9
Red Hat Advanced Cluster Security For Kubernetes 4.10
Red Hat Advanced Cluster Security For Kubernetes 4.11
Vendor
CVE Published:
6 July 2026

What is CVE-2026-9165?

A critical flaw exists in Red Hat Advanced Cluster Security for Kubernetes, where the authenticated GraphQL API does not enforce depth limitations on GraphQL queries. This can be exploited by an authenticated user with a valid API token, who may send complex and deeply nested queries leading to significant resource drain in Central. Such actions could eventually cause service disruptions, impacting the management plane's availability.

Affected Version(s)

Red Hat Advanced Cluster Security 4.9 1783357116

Red Hat Advanced Cluster Security for Kubernetes 4.10 1783357140

Red Hat Advanced Cluster Security for Kubernetes 4.11 1783352589

References

https://access.redhat.com/errata/RHSA-2026:36207
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36319
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36625
vendor-advisoryx_refsource_REDHAT

CVSS V3.1

Score:
7.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This issue was discovered by Moritz Clasmeier (Red Hat).
.