RHACS GraphQL API Depth Bypass Leading to DoS
CVE-2026-9165 Published on July 6, 2026
Stackrox: stackrox: unbounded graphql query depth allows authenticated denial of service
A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). Central does not limit the depth of GraphQL queries served on the authenticated GraphQL API. An authenticated user with a valid API token can send deeply nested queries that cause excessive resource consumption in Central, resulting in a denial of service for the management plane.
Vulnerability Analysis
CVE-2026-9165 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.
Timeline
Reported to Red Hat.
Made public. 46 days later.
Weakness Type
What is a Resource Exhaustion Vulnerability?
The software does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
CVE-2026-9165 has been classified to as a Resource Exhaustion vulnerability or weakness.
Products Associated with CVE-2026-9165
Want to know whenever a new CVE is published for Red Hat Advanced Cluster Security? stack.watch will email you.
