PT-2026-21899 · Red Hat · Red Hat Developer Hub+1

Bzimport · Published 2026-02-25 · Updated 2026-05-05 · CVE-2026-3118

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Red Hat Developer Hub (Backstage) Orchestrator Plugin (affected versions not specified)

Description A security flaw exists due to insufficient input validation in GraphQL query handling. An authenticated user can inject specially crafted input into API requests, disrupting backend query processing. This can cause the Backstage application to crash and restart, resulting in a Denial of Service (DoS) and temporary loss of access for legitimate users. The affected API requests involve GraphQL queries. The input within these queries is not properly validated.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-3118

Affected Products

Backstage

Red Hat Developer Hub

References · 9

• https://access.redhat.com/errata/RHSA-2026:13826 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:9742 · Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2026-3118 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-3118 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2442273 · Vendor Advisory
• https://t.me/CVEtracker/45728 · Telegram Post
• https://t.me/cveNotify/162266 · Telegram Post
• https://t.me/cveNotify/153546 · Telegram Post
• https://twitter.com/CVEnew/status/2026641306118725774 · Twitter Post