SQL Injection in Red Hat Developer Hub 1.8
CVE-2026-3118
A security flaw was identified in the Orchestrator Plugin of Red Hat Developer Hub (Backstage). The issue occurs due to insufficient input validation in GraphQL query handling. An authenticated user can inject specially crafted input into API requests, which disrupts backend query processing. This results in the entire Backstage application crashing and restarting, leading to a platform-wide Denial of Service (DoS). As a result, legitimate users temporarily lose access to the platform.
Vulnerability class: SQL Injection
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.006 (47.8th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 48th percentile — 47.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.006 · newest: 0.006 · change: -0.000
Affected products
- Red Hat Developer Hub 1.8 — versions 1776784286, sha256:bb763e2b7a9d101f73b03b9e1c5688e7034fd9d31413e890817bd4098a7d42f9
- Red Hat Developer Hub 1.9 — versions 1777903262
- Red Hat Developer Hub
Weakness classification (CWE)
References
- access.redhat.com/errata/RHSA-2026:9742 (vendor-advisory)
- access.redhat.com/security/cve/CVE-2026-3118 (vdb-entry, Vendor Advisory)
- bugzilla.redhat.com/show_bug.cgi (issue-tracking, Issue Tracking, Vendor Advisory)
- access.redhat.com/errata/RHSA-2026:13826 (vendor-advisory)
Frequently asked questions
- What is CVE-2026-3118?
- CVE-2026-3118 is a medium-severity vulnerability in Red Hat Developer Hub 1.8, classified under SQL Injection. CVSS score: 6.5/10. Published 2026-02-25.
- How severe is CVE-2026-3118?
- Medium severity. CVSS v3 base score is 6.5 out of 10.