A flaw in the Orchestrator Plugin of Red Hat Developer Hub allows an authenticated user to inject malicious input into GraphQL queries. Because the plugin performs insufficient input validation, the crafted request disrupts backend query processing, causing the entire Backstage application to crash and restart. As a result, legitimate users experience a platform‑wide denial of service for the duration of the restart cycle.

The vulnerability affects Red Hat Developer Hub (Backstage). No specific product version information is provided in the public data, so all deployments of the Red Hat Developer Hub that include the Orchestrator Plugin are potentially impacted.

The CVSS Base score is 6.5, denoting a medium severity vulnerability, while the EPSS score is reported as less than 1 %, indicating a very low probability of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Exploitation appears to require an attacker with valid credentials capable of accessing the GraphQL API; the attack pattern is based on authenticated exploitation. Although the exploit is not currently widespread, the impact of each successful attack is significant because it brings down the entire platform.