Vulnerability · Published Feb 25, 2026 · Assigned by redhat

CVE-2026-3118Rhdh: graphql injection leading to platform-wide denial of service (dos) in rh developer hub orchestrator plugin

Medium 6.5

In plain English

A medium-severity SQL injection in Red Hat Developer Hub 1.8 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.6%top 52.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A security flaw was identified in the Orchestrator Plugin of Red Hat Developer Hub (Backstage). The issue occurs due to insufficient input validation in GraphQL query handling. An authenticated user can inject specially crafted input into API requests, which disrupts backend query processing. This results in the entire Backstage application crashing and restarting, leading to a platform-wide Denial of Service (DoS). As a result, legitimate users temporarily lose access to the platform.

Affected products (as reported)

Vendor	Product	Versions
Red Hat	Red Hat Developer Hub 1.8	see references
Red Hat	Red Hat Developer Hub 1.9	see references

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

RHSA-2026:13826 vendor-advisory, x_refsource_REDHAT
RHSA-2026:9742 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2026-3118 vdb-entry, x_refsource_REDHAT
RHBZ#2442273 issue-tracking, x_refsource_REDHAT