CVE-2026-3118
Medium
Description
A security flaw was identified in the Orchestrator Plugin of Red Hat Developer Hub (Backstage). The issue occurs due to insufficient input validation in GraphQL query handling. An authenticated user can inject specially crafted input into API requests, which disrupts backend query processing. This results in the entire Backstage application crashing and restarting, leading to a platform-wide Denial of Service (DoS). As a result, legitimate users temporarily lose access to the platform.
SeverityMedium
CVSS6.5
Exploit probability—
Product
Redhat Developer Hub
PublishedFeb 25, 2026
First seenFeb 25, 2026
Weakness typeCWE-89SQL injection
How to fix
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat developer_hub | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.