Resource exhaustion in Red Hat Advanced Cluster Security 4
CVE-2026-9165
A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). Central does not limit the depth of GraphQL queries served on the authenticated GraphQL API. An authenticated user with a valid API token can send deeply nested queries that cause excessive resource consumption in Central, resulting in a denial of service for the management plane.
Vulnerability class: DoS (Denial of Service)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.7 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.005 (44.1th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 44th percentile — 44.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: 0.000
Affected products
- Red Hat Advanced Cluster Security 4
- Red Hat Advanced Cluster Security 4.9 — versions 1783357116
- Red Hat Advanced Cluster Security For Kubernetes 4.10 — versions 1783357140
- Red Hat Advanced Cluster Security For Kubernetes 4.11 — versions 1783352589
- Red Hat Advanced Cluster Security For Kubernetes 4.9 — versions 1783357116
Weakness classification (CWE)
References
- access.redhat.com/security/cve/CVE-2026-9165 (vdb-entry)
- bugzilla.redhat.com/show_bug.cgi (issue-tracking)
- access.redhat.com/errata/RHSA-2026:36319 (vendor-advisory)
- access.redhat.com/errata/RHSA-2026:36207 (vendor-advisory)
- access.redhat.com/errata/RHSA-2026:36625 (vendor-advisory)
Frequently asked questions
- What is CVE-2026-9165?
- CVE-2026-9165 is a high-severity vulnerability in Red Hat Advanced Cluster Security 4, classified under Uncontrolled Resource Consumption. CVSS score: 7.7/10. Published 2026-07-06.
- How severe is CVE-2026-9165?
- High severity. CVSS v3 base score is 7.7 out of 10.