What’s Vulnerable › Vulnerabilities

CVE-2026-3118: Rhdh: graphql injection leading to platform-wide denial of service (dos) in rh developer hub orchestrator plugin

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-02-25 · updated 2026-06-17
• Weakness: CWE-89

Description

A security flaw was identified in the Orchestrator Plugin of Red Hat Developer Hub (Backstage). The issue occurs due to insufficient input validation in GraphQL query handling. An authenticated user can inject specially crafted input into API requests, which disrupts backend query processing. This results in the entire Backstage application crashing and restarting, leading to a platform-wide Denial of Service (DoS). As a result, legitimate users temporarily lose access to the platform.

Affected products

• RedHat Developer Hub: all versions

References

• https://access.redhat.com/errata/RHSA-2026:13826
• https://access.redhat.com/errata/RHSA-2026:9742
• https://access.redhat.com/security/cve/CVE-2026-3118
• https://bugzilla.redhat.com/show_bug.cgi?id=2442273

Get alerted when CVE-2026-3118 or the next vulnerability affects your stack