A security vulnerability (CVE-2026-3118) exists in the Orchestrator Plugin of Red Hat Developer Hub (Backstage) due to insufficient input validation in GraphQL query handling. An authenticated user can inject crafted input into API requests, causing the backend query processing to fail and the entire application to crash and restart. This leads to a platform-wide denial of service, temporarily preventing legitimate users from accessing the platform.