Bug 2442273 (CVE-2026-3118)

Summary:	CVE-2026-3118 rhdh: GraphQL Injection Leading to Platform-Wide Denial of Service (DoS) in RH Developer Hub Orchestrator Plugin
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	abarbaro, alizardo, jchui, jhe, ktsao, nboldt, psrna
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A security flaw was identified in the Orchestrator Plugin of Red Hat Developer Hub (Backstage). The issue occurs due to insufficient input validation in GraphQL query handling. An authenticated user can inject specially crafted input into API requests, which disrupts backend query processing. This results in the entire Backstage application crashing and restarting, leading to a platform-wide Denial of Service (DoS). As a result, legitimate users temporarily lose access to the platform.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-02-24 12:13:46 UTC

GraphQL Injection vulnerability in the Orchestrator Plugin of RH Developer Hub (Backstage). The flaw is caused by improper neutralization of special characters within user-supplied input fields that are directly embedded into backend GraphQL queries. By submitting specially crafted JSON payloads containing malicious GraphQL fragments (e.g., manipulated orderBy or filter values), an authenticated attacker can break query structure and trigger unhandled exceptions. This results in the entire Backstage application crashing and automatically restarting, leading to a platform-wide Denial of Service. The vulnerability can be exploited remotely by any authenticated user without additional privileges or user interaction, causing a high impact on service availability.