CVE-2026-9165
HighCVSS 7.7Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
A flaw in Red Hat Advanced Cluster Security for Kubernetes (RHACS) allows an authenticated user with a valid API token to send deeply nested GraphQL queries, causing excessive resource consumption in Central and resulting in a denial of service for the management plane.
Risk Assessment
An attacker can exhaust Central's resources, preventing Kubernetes cluster management and security monitoring, leading to system downtime.
Recommendation
Update RHACS to a version containing the fix that limits GraphQL query depth and consider implementing additional rate-limiting mechanisms at the API level.
Original NVD description (English source)
A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). Central does not limit the depth of GraphQL queries served on the authenticated GraphQL API. An authenticated user with a valid API token can send deeply nested queries that cause excessive resource consumption in Central, resulting in a denial of service for the management plane.