CVE-2026-18381
HighCVSS 7.6Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
A flaw was found in the koku-metrics-operator for Red Hat OpenShift. The CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary upload URL. The operator attaches its own Kubernetes service-account bearer token to queries sent to this URL, allowing the attacker to obtain the token.
Risk Assessment
The risk is theft of the Kubernetes service account token, potentially leading to unauthorized access to cluster resources.
Recommendation
Restrict edit permissions on the CostManagementMetricsConfig resource and ensure upload URLs are trusted.
Other vulnerabilities in koku-metrics-operator
See all- CVE-2026-18382Medium
A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary OAuth token endpoint. When authentication.type is set to service-account, the operator sends the tenant's Red Hat SSO client_id and client_secret to this user-controlled URL, allowing the attacker to obtain the credentials.
- CVE-2026-18378High
A flaw was found in koku-metrics-operator. The CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary upload URL. When authentication.type is set to token (default), the cluster-global Red Hat Cloud pull-secret bearer token is attached to HTTP requests sent to this URL, allowing the attacker to obtain the token.
Original NVD description (English source)
A flaw was found in the koku-metrics-operator for Red Hat OpenShift. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary upload URL. The operator attaches its own Kubernetes service-account bearer token to queries sent to this user-controlled URL, allowing the attacker to obtain the token.