CVE-2026-3118
Rhdh: graphql injection leading to platform-wide denial of service (dos) in rh developer hub orchestrator plugin
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
A security flaw was identified in the Orchestrator Plugin of Red Hat Developer Hub (Backstage). The issue occurs due to insufficient input validation in GraphQL query handling. An authenticated user can inject specially crafted input into API requests, which disrupts backend query processing. This results in the entire Backstage application crashing and restarting, leading to a platform-wide Denial of Service (DoS). As a result, legitimate users temporarily lose access to the platform.
| CWE | CWE-89 |
| Vendor | red hat |
| Product | red hat developer hub |
| Published | Feb 25, 2026 |
| Last Updated | Mar 2, 2026 |
Stay Ahead of the Next One
Get instant alerts for red hat red hat developer hub
Be the first to know when new medium vulnerabilities affecting red hat red hat developer hub are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected Versions
Red Hat / Red Hat Developer Hub
All versions affected References
Credits
Red Hat would like to thank Thibault Guittet for reporting this issue.