CVE-2026-9165

highCVSS 7.7covered by 1 sourcefirst seen 2026-07-06

A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). Central does not limit the depth of GraphQL queries served on the authenticated GraphQL API. An authenticated user with a valid API token can send deeply nested queries that cause excessive resource consumption in Central, resulting in a denial of service for the management plane.

⚡ Watch CVE-2026-9165

Get an email if CVE-2026-9165 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.32% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 24% of all EPSS-scored CVEs.

Advisory coverage (1)

highCVE-2026-9165: A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). Central does not …nvd · 2026-07-06

External references

NVD record for CVE-2026-9165

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-9165 status](https://www.csirts.com/badge/CVE-2026-9165)](https://www.csirts.com/cve/CVE-2026-9165)