CVE-2026-18378
HighCVSS 7.6Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
A flaw was found in koku-metrics-operator. The CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary upload URL. When authentication.type is set to token (default), the cluster-global Red Hat Cloud pull-secret bearer token is attached to HTTP requests sent to this URL, allowing the attacker to obtain the token.
Risk Assessment
The risk is theft of the Red Hat Cloud pull-secret token, potentially leading to unauthorized access to Red Hat cloud resources.
Recommendation
Restrict edit permissions on the CostManagementMetricsConfig resource and consider changing the authentication type to a more secure method.
Other vulnerabilities in koku-metrics-operator
See all- CVE-2026-18382Medium
A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary OAuth token endpoint. When authentication.type is set to service-account, the operator sends the tenant's Red Hat SSO client_id and client_secret to this user-controlled URL, allowing the attacker to obtain the credentials.
- CVE-2026-18381High
A flaw was found in the koku-metrics-operator for Red Hat OpenShift. The CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary upload URL. The operator attaches its own Kubernetes service-account bearer token to queries sent to this URL, allowing the attacker to obtain the token.
Original NVD description (English source)
A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows user able to edit the CR to specify an arbitrary upload URL. When authentication.type is set to token (the default), the cluster-global Red Hat Cloud pull-secret bearer token is attached to HTTP requests sent to this user-controlled URL, allowing the attacker to obtain the token.