VulnerabilityModified

CVE-2026-3118

An authenticated user can inject specially crafted input into API requests, which disrupts backend query processing.

MEDIUM 6.5EPSS 0.53%

Does this matter?

Lower severity and a low EPSS score (0.53%). Track it; it rarely justifies an emergency change on its own.

Description

A security flaw was identified in the Orchestrator Plugin of Red Hat Developer Hub (Backstage). The issue occurs due to insufficient input validation in GraphQL query handling. An authenticated user can inject specially crafted input into API requests, which disrupts backend query processing. This results in the entire Backstage application crashing and restarting, leading to a platform-wide Denial of Service (DoS). As a result, legitimate users temporarily lose access to the platform.

CVSS 3.1: 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS: 0.53% probability · 43th percentile
CISA KEV: Not listed
Weakness: CWE-89
Affected: redhat/developer hub
Source: secalert@redhat.com

References

https://access.redhat.com/errata/RHSA-2026:13826
https://access.redhat.com/errata/RHSA-2026:9742
https://access.redhat.com/security/cve/CVE-2026-3118Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2442273Issue Tracking, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.