Attack Chain

1. Initial Access (Prerequisite): An attacker gains unauthorized access to a valid API token for the Red Hat Advanced Cluster Security for Kubernetes (RHACS) Central component, potentially through credential compromise or misconfiguration.
2. API Identification: The attacker identifies the authenticated GraphQL API endpoint exposed by the RHACS Central component.
3. Query Crafting: The attacker constructs a GraphQL query with an intentionally deep and complex nesting structure, designed to demand significant computational resources from the server.
4. Authenticated Request: The crafted, deeply nested GraphQL query is sent by the attacker to the RHACS Central authenticated GraphQL API, using the previously obtained valid API token.
5. Uncontrolled Resource Consumption: RHACS Central's GraphQL API processes the received query without enforcing limits on query depth or complexity, causing an exponential increase in its resource utilization (CPU, memory, network).
6. System Degradation: The Central component's performance rapidly deteriorates as it struggles to manage the overwhelming resource demands imposed by the malicious query.
7. Denial of Service: The RHACS Central management plane becomes unresponsive or crashes due to resource exhaustion, effectively preventing legitimate administrative access and rendering the security platform inoperable.
8. Operational Impact: Security operations are disrupted, leading to a loss of visibility, control, and enforcement capabilities for the targeted Kubernetes clusters, potentially creating a window for further attacks or compliance breaches.

Impact

The primary impact of CVE-2026-9165 is a denial of service (DoS) for the management plane of Red Hat Advanced Cluster Security for Kubernetes. This means that administrators would be unable to access, configure, or monitor their cluster security posture through the RHACS Central interface. Such an outage could lead to significant operational disruptions, potentially hindering the ability to respond to ongoing security incidents, apply necessary policy updates, or maintain compliance. While no specific victim counts or targeted sectors are provided, any organization utilizing vulnerable versions of RHACS could be affected, facing a critical loss of their security control plane.

Recommendation

• Patch CVE-2026-9165: Immediately apply the security updates provided by Red Hat to remediate CVE-2026-9165 on all affected Red Hat Advanced Cluster Security for Kubernetes Central components.
• Monitor RHACS Central Resources: Monitor the CPU, memory, and network utilization of your RHACS Central components for unusual spikes or sustained high usage, which could indicate attempted exploitation of the vulnerability.
• Review API Access: Regularly audit and rotate API tokens used for RHACS Central to minimize the window of opportunity for an attacker using a compromised token.