{"id":"CVE-2026-9165","title":"A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS)","summary":"A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). Central does not limit the depth of GraphQL queries served on the authenticated GraphQL API. An authenticated user with a valid API token can send deeply neste…","severity":"high","cvss":7.7,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","cwe":["CWE-400"],"vendor":"Red Hat","product":"advanced-cluster-security/rhacs-main-rhel8","affected":["advanced-cluster-security/rhacs-main-rhel8 (all versions)","advanced-cluster-security/rhacs-main-rhel8 (all versions)","advanced-cluster-security/rhacs-main-rhel9 (all versions)","advanced-cluster-security/rhacs-main-rhel11 (all versions)"],"published":"2026-07-06","updated":"2026-09-08","sourceUpdated":"2026-09-08T08:17:13.800","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-9165","references":[{"url":"https://access.redhat.com/errata/RHSA-2026:36207","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:36319","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:36625","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-9165","label":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2480505","label":"secalert@redhat.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9165.json"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-9165"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9165"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-07-07T14:00:57.848857Z"},"epss":0.00548,"epssPercentile":0.44553,"ingestedAt":"2026-07-19T01:26:59.159Z","patched":["advanced_cluster_security 4.9","advanced_cluster_security_for_kubernetes 4.10","advanced_cluster_security_for_kubernetes 4.11"],"slug":"CVE-2026-9165","body":"## Overview\n\nA flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). Central does not limit the depth of GraphQL queries served on the authenticated GraphQL API. An authenticated user with a valid API token can send deeply nested queries that cause excessive resource consumption in Central, resulting in a denial of service for the management plane.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2026:36319** · Red Hat · fixed in: Red Hat Advanced Cluster Security 4.9 · released 2026-07-07 · [advisory](https://access.redhat.com/errata/RHSA-2026:36319)\n- **RHSA-2026:36625** · Red Hat · fixed in: Red Hat Advanced Cluster Security for Kubernetes 4.10 · released 2026-07-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:36625)\n- **RHSA-2026:36207** · Red Hat · fixed in: Red Hat Advanced Cluster Security for Kubernetes 4.11 · released 2026-07-07 · [advisory](https://access.redhat.com/errata/RHSA-2026:36207)\n- **Red Hat VEX** · Important · affected: Red Hat Advanced Cluster Security 4 · no fix planned: Red Hat Advanced Cluster Security 4 · updated 2026-09-08 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9165.json)","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":42.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}