RHACS Central CVE-2026-9165

Exploitation requires an authenticated session against Central's GraphQL API - specifically a valid RHACS API token (PR:L) - and network reachability to the Central endpoint (AV:N). The exact trigger is a deeply nested GraphQL query sent to the authenticated GraphQL API, exploiting the absence of any query-depth limit; no user interaction and no non-default configuration are needed since the missing depth cap is the default behavior. Limiting factors that reduce real-world risk: the attacker must already possess a legitimate API token, so exposure is bounded by how many tokens exist and how well they are guarded, and by whether the Central API is reachable only from trusted management networks rather than broadly exposed.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H (7.7, High) is internally consistent with the description: network-reachable API, low complexity, low privileges (a valid API token), no user interaction, and a pure availability impact with no confidentiality or integrity loss. Red Hat scored Scope as Changed (S:C), presumably because a downed Central degrades security monitoring across all managed clusters; a more conservative reading treats the resource exhaustion as confined to Central itself (S:U), which would lower the score - this is the main point of divergence and should be verified against Red Hat's advisory. No EPSS score, KEV entry, or POC was provided, so exploitation probability cannot be quantified from the input; there is no public exploit identified at time of analysis. Net: this is a credible operational-availability risk for RHACS operators rather than a critical breach vector, and its real priority hinges on how exposed the Central GraphQL endpoint is and how tightly API tokens are controlled.

An insider or a user whose RHACS API token has leaked authenticates to Central's GraphQL API and submits a single deeply nested query. Central attempts to resolve the exponentially expanding query tree, spiking CPU and memory until it becomes unresponsive, cutting off security policy enforcement and monitoring for every cluster Central manages. The low attack complexity means the query can be crafted and replayed with no special tooling; no public POC is identified at time of analysis.