Moritz Clasmeier

**Name of the Vulnerable Software and Affected Versions** Red Hat Advanced Cluster Security for Kubernetes (RHACS) (affected versions not specified) **Description** A flaw exists when processing Kubernetes Deployments where the system replaces deployment identity metadata based on the `openshift.io/encoded-deployment-config` label. A user with permissions to create Deployments can set this label to "null", leading the system to treat the workload as having an empty UID, name, labels, and the "default" namespace. This results in a bypass of deploy-time policy detection and enforcement visibility, prevents correct persistence in Central, and disrupts violation reporting and compliance correlation for the affected deployment. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Red Hat Advanced Cluster Security for Kubernetes (affected versions not specified) **Description** Central does not limit the depth of GraphQL queries served on the authenticated GraphQL API. An authenticated user with a valid API token can send deeply nested queries that cause excessive resource consumption in Central, resulting in a denial of service for the management plane. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.