CVE-2026-9165 Overview
CVE-2026-9165 is a denial-of-service vulnerability in Red Hat Advanced Cluster Security for Kubernetes (RHACS). The Central component fails to limit the depth of GraphQL queries served through its authenticated GraphQL API. An authenticated user holding a valid API token can submit deeply nested queries that force Central to consume excessive CPU and memory resources. The result is a denial of service against the RHACS management plane, disrupting security operations for the affected Kubernetes clusters. The flaw is tracked under CWE-400: Uncontrolled Resource Consumption and carries a CVSS 3.1 score of 7.7.
Critical Impact
An authenticated attacker with a valid API token can crash or render Central unresponsive, disabling the RHACS management plane and blocking security visibility across protected Kubernetes workloads.
Affected Products
- Red Hat Advanced Cluster Security for Kubernetes (RHACS) - Central component
- RHACS deployments exposing the authenticated GraphQL API
- Managed Kubernetes environments relying on RHACS Central for policy enforcement
Discovery Timeline
- 2026-07-06 - CVE-2026-9165 published to NVD
- 2026-07-08 - Last updated in NVD database
Technical Details for CVE-2026-9165
Vulnerability Analysis
RHACS Central exposes a GraphQL API used for querying policy, alert, image, and cluster data. GraphQL allows clients to construct nested queries that traverse related object types. Without depth or complexity limits, a single request can force the server to resolve exponentially expanding object graphs. Central lacks these protections, allowing authenticated callers to trigger CPU and memory exhaustion with a small number of requests. Because the scope is Changed (S:C), impact extends beyond Central itself to the wider RHACS management plane that depends on it. The flaw is categorized as a GraphQL API vulnerability and an algorithmic complexity denial-of-service condition.
Root Cause
The root cause is missing input validation on GraphQL query structure. Central does not enforce maximum query depth, maximum query complexity, or resolver-level cost analysis before executing incoming operations. Standard GraphQL hardening controls such as depth limiting middleware, cost analysis, or automatic persisted queries are absent from the authenticated endpoint.
Attack Vector
Exploitation requires an authenticated user with a valid API token, which lowers but does not remove the barrier to abuse. Any account with GraphQL query access - including read-only integrations, CI/CD service accounts, or compromised low-privilege tokens - can trigger the condition. The attacker sends one or more deeply nested queries traversing recursive object relationships. Central attempts to resolve each nested selection, consuming resources until the process becomes unresponsive or is terminated by the container runtime.
No verified public exploit code is available at this time. See Red Hat CVE-2026-9165 Information and Red Hat Bugzilla Report #2480505 for vendor technical details.
Detection Methods for CVE-2026-9165
Indicators of Compromise
- Unusually large or deeply nested GraphQL query payloads sent to Central's /api/graphql endpoint.
- Sustained high CPU and memory utilization on the Central pod without a corresponding increase in legitimate user activity.
- Central pod restarts or OOMKilled events in Kubernetes correlated with API token authentication events.
- Slow or timing-out responses from the RHACS UI and API clients during periods of elevated GraphQL traffic.
Detection Strategies
- Enable GraphQL request logging on Central and alert on query depth or payload size exceeding baseline thresholds.
- Correlate API token identifiers with request volume to identify a single token driving anomalous query load.
- Monitor Kubernetes events for OOMKilled or repeated restarts of the Central deployment.
Monitoring Recommendations
- Track pod-level CPU, memory, and request latency metrics for the Central workload through Prometheus or an equivalent stack.
- Alert on 5xx error rates and request duration spikes on the GraphQL endpoint.
- Audit API token issuance and usage patterns, revoking tokens that generate abnormal query volume.
How to Mitigate CVE-2026-9165
Immediate Actions Required
- Apply the fixed RHACS builds referenced in RHSA-2026:36207, RHSA-2026:36319, and RHSA-2026:36625.
- Inventory active API tokens and revoke any that are unused, over-privileged, or issued to inactive integrations.
- Restrict network access to Central's GraphQL endpoint using Kubernetes NetworkPolicies or ingress controls so that only trusted clients can reach it.
Patch Information
Red Hat has released fixed versions of RHACS via RHSA-2026:36207, RHSA-2026:36319, and RHSA-2026:36625. Administrators should upgrade Central to a patched release that enforces GraphQL query depth limits. Refer to Red Hat CVE-2026-9165 Information for the exact fixed component versions.
Workarounds
- Limit issuance of API tokens to trusted integrations and use short token lifetimes where possible.
- Place a reverse proxy or API gateway in front of Central that enforces request body size limits and rate limiting on the GraphQL endpoint.
- Set conservative CPU and memory requests plus horizontal pod autoscaling on Central to reduce the blast radius while patching is scheduled.
- Increase monitoring sensitivity on Central pod health so that resource exhaustion is detected early and remediated by restart automation.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
