CVE-2026-9165: Red Hat RHACS GraphQL Denial of Service Vulnerability

Technical summary

CVE-2026-9165 is a resource exhaustion vulnerability in Red Hat Advanced Cluster Security for Kubernetes Central's GraphQL API endpoint. The flaw stems from the absence of depth-limiting controls on GraphQL query recursion. An authenticated API client can submit deeply nested queries that force the GraphQL parser and executor to allocate unbounded memory and CPU resources, ultimately crashing or severely degrading Central's availability. The attack surface is limited to authenticated requests, but the CVSS 3.1 score of 7.7 (HIGH) reflects the wide network exposure (AV:N) and severe availability impact (A:H) despite the low authentication barrier (PR:L).

Business impact

Central is the command-and-control component of RHACS, orchestrating policy enforcement, compliance monitoring, and threat detection across Kubernetes clusters. A successful denial-of-service attack renders the entire management plane inoperative, halting visibility into running containers, blocking policy updates, and preventing incident response activities. For organizations managing production Kubernetes environments, this translates to loss of security posture visibility and inability to enforce runtime protections during the attack window. The impact is particularly severe if the attacker has sustained access via a compromised service account or API token.

Affected systems

The vulnerability affects Red Hat Advanced Cluster Security for Kubernetes installations where Central is exposed to authenticated API consumers. Any deployment where API tokens have been issued to users, third-party integrations, or automation tools is potentially at risk. The vulnerability does not affect downstream Kubernetes cluster agents; the attack target is Central itself.

Exploitability

Exploitation requires valid API authentication credentials and network access to the Central GraphQL endpoint. The attacker need not possess administrative privileges within RHACS—any authenticated user can trigger the denial of service. No user interaction, complex exploitation steps, or client-side tricks are needed; a single malicious GraphQL request suffices. The primary barrier is obtaining valid API credentials; once acquired, the attack is trivial to execute and difficult to distinguish from legitimate but expensive queries without proper monitoring.

Remediation

Remediation requires applying a Red Hat security update to RHACS Central that implements GraphQL query depth limiting and resource quotas. Organizations should verify availability of patches through official Red Hat security advisories and apply them according to your change management processes. Until patched, reduce the attack surface by restricting API token distribution, implementing network segmentation to limit GraphQL endpoint access, and monitoring for unusually complex or deeply nested query patterns.

Patch guidance

Consult the Red Hat Security Advisory for CVE-2026-9165 to identify the specific RHACS version and patch release required for your installation. Red Hat typically provides cumulative security updates; verify compatibility with your current Central deployment and test in a non-production environment before rolling out to production clusters. Review your API token inventory during the patch process and revoke any tokens that are no longer actively used.

Detection guidance

Monitor Central's GraphQL API logs for queries with exceptionally high nesting depth or recursive fragments. Set baseline thresholds for query execution time and memory consumption; alerting on queries that exceed 10–15× normal resource usage may indicate an attack attempt. Watch for repeated failed or timeout responses from the GraphQL endpoint, and correlate with API token usage logs to identify which accounts are submitting resource-intensive queries. Network-level monitoring for sustained traffic to the GraphQL endpoint from a single authenticated session can also surface exploitation attempts.

Why prioritize this

Although this vulnerability requires authentication, the combination of HIGH severity, high network accessibility, and operational criticality of RHACS Central in Kubernetes security workflows warrants near-immediate attention. Insider threats and credential compromise are common attack vectors; the barrier to exploitation is low once credentials are obtained. Organizations should prioritize patching ahead of non-authenticated vulnerabilities and especially before expanding API token distribution.

Risk score, explained

The CVSS 3.1 score of 7.7 reflects a high-severity denial-of-service condition affecting a critical security management component, accessible over the network to any authenticated user. The score appropriately weights the availability impact (A:H) and attack complexity (AC:L) against the requirement for prior authentication (PR:L). The impact is scoped to Central itself, not to downstream clusters or host systems, which slightly moderates the score; however, Central's role as the security control plane means its unavailability cascades into loss of visibility and enforcement capability across your entire Kubernetes estate.

Frequently asked questions