High severity · published Jul 6, 2026
CVE-2026-9165
Stackrox: stackrox: unbounded graphql query depth allows authenticated denial of service
7.7
CVSS
0.5%
EPSS
No
On KEV
Description
A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). Central does not limit the depth of GraphQL queries served on the authenticated GraphQL API. An authenticated user with a valid API token can send deeply nested queries that cause excessive resource consumption in Central, resulting in a denial of service for the management plane.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RH
Red Hat Advanced Cluster Security 4 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Advanced Cluster Security 4.9 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Advanced Cluster Security for Kubernetes 4.10 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Advanced Cluster Security for Kubernetes 4.11 · Red Hat
All versions, or not specified · source: vendor
Affected product
RH
Red Hat Advanced Cluster Security 4
Red Hat
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-9165
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-9165
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:36207
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:36319
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:36625
access.redhat.com
https://access.redhat.com/security/cve/CVE-2026-9165
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2480505
More from Red Hat Advanced Cluster Security 4
9.8
CVE-2026-33816
CVE-2026-33816 in github.com/jackc/pgx
9.8
CVE-2026-33815
CVE-2026-33815 in github.com/jackc/pgx
9.8
CVE-2025-56005
An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via the `picklefile` parameter in the `yacc()` function
9.1
CVE-2026-39830
Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh
9.1
CVE-2026-39832
Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent