CVE-2026-18382
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary OAuth token endpoint. When authentication.type is set to service-account, the operator sends the tenant's Red Hat SSO client_id and client_secret to this user-controlled URL, allowing the attacker to obtain the credentials.
Risk Assessment
The risk includes theft of Red Hat SSO credentials, potentially leading to unauthorized access to resources and systems managed by the operator.
Recommendation
It is recommended to restrict permissions to edit the CostManagementMetricsConfig resource and update koku-metrics-operator to a version containing a fix.
Other vulnerabilities in koku-metrics-operator
See all- CVE-2026-18381High
A flaw was found in the koku-metrics-operator for Red Hat OpenShift. The CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary upload URL. The operator attaches its own Kubernetes service-account bearer token to queries sent to this URL, allowing the attacker to obtain the token.
- CVE-2026-18378High
A flaw was found in koku-metrics-operator. The CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary upload URL. When authentication.type is set to token (default), the cluster-global Red Hat Cloud pull-secret bearer token is attached to HTTP requests sent to this URL, allowing the attacker to obtain the token.
Original NVD description (English source)
A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary OAuth token endpoint. When authentication.type is set to service-account, the operator sends the tenant's Red Hat SSO client_id and client_secret to this user-controlled URL, allowing the attacker to obtain the credentials.