CVE-2026-9165 Red Hat CVE debrief

Who should care

Users of Red Hat Advanced Cluster Security for Kubernetes (RHACS) should be aware of this vulnerability and take steps to mitigate it. This includes administrators and security teams responsible for managing RHACS deployments, as well as developers who interact with the GraphQL API. These stakeholders should assess their exposure, review compensating controls, and apply patches or updates provided by Red Hat to prevent exploitation.

Technical summary

The vulnerability exists in the GraphQL API of Red Hat Advanced Cluster Security for Kubernetes (RHACS) Central. The API does not limit the depth of GraphQL queries, allowing an authenticated user with a valid API token to send deeply nested queries. These queries can cause excessive resource consumption in Central, leading to a denial of service for the management plane. This issue arises because the GraphQL API does not enforce a maximum query depth, which can be exploited by users with valid API tokens. To mitigate this, users should review and limit the depth of GraphQL queries served on the authenticated GraphQL API.

Defensive priority

Highly Critical

Recommended defensive actions

• Review and limit the depth of GraphQL queries served on the authenticated GraphQL API
• Implement input validation and sanitization for GraphQL queries
• Monitor for and restrict excessive resource consumption in Central
• Apply patches or updates provided by Red Hat
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-07-06T09:16:39.400Z and was last modified on 2026-07-07T19:16:55.697Z. The NVD entry is currently Awaiting Analysis. This information is based on the provided source corpus. Further verification is recommended to confirm the accuracy of this information. The vulnerability's impact on resource consumption and potential denial of service should be verified through testing or simulation.

Official resources