EUVD-2026-51094
GHSA-8jfr-h5wv-8vhv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain edit rights on CostManagementMetricsConfig CR
-
DeliverySet upload URL to attacker-controlled host
-
ExploitOperator attaches Red Hat Cloud pull-secret token
-
ExecutionCapture bearer token from inbound request
-
ImpactReuse token against Red Hat Cloud
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the attacker already have permission to edit the CostManagementMetricsConfig custom resource (a namespaced OpenShift/Kubernetes RBAC grant), and that the operator be running with the default authentication.type=token so the cluster-global Red Hat Cloud pull-secret bearer token is attached to uploads. The single required action is setting the CR's upload URL to an attacker-controlled host. Limiting factors: this is not remotely reachable without that edit privilege (PR:H), so it is fundamentally a privileged-insider / compromised-service-account scenario; if authentication.type is changed away from token, or if the shared pull secret is not used, the token disclosure does not occur. |
| Impact | The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N, base 7.6) is internally consistent with the description: network vector because the token is exfiltrated to a remote URL, low complexity, but PR:H because the attacker must already hold RBAC permission to edit the CostManagementMetricsConfig CR - this is not an unauthenticated internet-facing bug. The scope change (S:C) and high confidentiality reflect that the leaked pull secret is cluster-global and grants access to an out-of-band system (Red Hat Cloud) beyond the operator itself. No EPSS score, SSVC decision, KEV entry, or POC is present in the supplied data; combined with the PR:H prerequisite this points to a real but bounded, insider/privilege-abuse-oriented risk rather than mass exploitation. The main uncertainty is what edit privilege realistically requires in practice - verify who can edit the CR (namespace admin vs. cluster admin) with the Red Hat advisory, as that governs the true blast radius. |
| Exploit ScenarioDerived | A tenant or service account holding edit permission on the CostManagementMetricsConfig CR changes the upload URL to a server they control. On the next scheduled upload the operator attaches the cluster-global Red Hat Cloud pull-secret bearer token to the request, and the attacker captures the token from their web log and reuses it against Red Hat Cloud services. No user interaction or additional exploit code is required, though the attacker must first obtain the ability to edit the CR. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Bearer-token disclosure in the Red Hat koku-metrics-operator lets a user with edit rights over the CostManagementMetricsConfig custom resource redirect metric uploads to an attacker-controlled URL, causing the operator to attach the cluster-global Red Hat Cloud pull-secret token to that outbound request and leak it. Because token authentication is the default (authentication.type=token) and the pull secret is shared cluster-wide, a single privileged tenant can harvest credentials that grant access to the organization's Red Hat Cloud/console.redhat.com services. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the issue was reported directly by Red Hat's security team.
RemediationAI
No vendor-released patched version is identified in the available data, so track https://access.redhat.com/security/cve/CVE-2026-18378 and Bugzilla 2509249 for the fixed operator build and upgrade to it once published. As immediate compensating controls: tightly restrict RBAC so that only trusted cluster/namespace administrators can create or edit CostManagementMetricsConfig resources (this directly removes the PR:H prerequisite the attack depends on, at the cost of centralizing config changes); where feasible, switch authentication.type from the default token to service-account/basic credentials scoped to the intended endpoint rather than the cluster-global pull secret so the shared token is never attached; and enforce egress network policy so the operator can only reach legitimate Red Hat Cloud upload hosts (console.redhat.com), which neutralizes exfiltration to arbitrary URLs but will break uploads if the destination changes. Rotate the Red Hat Cloud pull secret if you suspect the CR was tampered with.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The koku-metrics-operator is an OpenShift/Kubernetes operator that collects cluster cost-management metrics and periodically uploads them to Red Hat Cloud (cost management / console.redhat.com), authenticating with the cluster's global Red Hat Cloud pull-secret bearer token. The flaw is a classic Server-Side Request Forgery (CWE-918): the upload destination is taken from the user-editable CostManagementMetricsConfig CR without restricting it to trusted Red Hat endpoints, so the operator will faithfully send its bearer token to whatever host the CR names. The root cause is that the secret is bound to the request rather than to a validated, allow-listed destination, turning a data-egress feature into a credential-exfiltration primitive.
Know when Cost Management Metrics Operator gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
PR:H because the attacker must already have RBAC to edit the CR; AV:N/S:C/C:H reflect network exfiltration of a cluster-global token affecting an external system; no integrity/availability impact.
Primary rating from Vendor (redhat).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows user able to edit the CR to specify an arbitrary upload URL. When authentication.type is set to token (the default), the cluster-global Red Hat Cloud pull-secret bearer token is attached to HTTP requests sent to this user-controlled URL, allowing the attacker to obtain the token.
Executive ViewAI
Red Hat koku-metrics-operator contains a credential disclosure flaw that enables privileged cluster users to extract the organization's Red Hat Cloud authentication token and redirect metric uploads to attacker-controlled systems. Compromise of these credentials grants full access to Red Hat Cloud services and affects any organization using this operator in production Kubernetes environments.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) enforce strict RBAC controls restricting CostManagementMetricsConfig edit access to infrastructure teams only; (2) deploy network egress policies limiting the operator to authorized metric endpoints; (3) enable comprehensive audit logging for all CostManagementMetricsConfig modifications; (4) disable the operator entirely if cost telemetry is not operationally critical; (5) establish and test Red Hat Cloud credential rotation procedures for rapid execution if compromise is suspected.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Affected Products (CPE)NVD
Service-account token disclosure in the Red Hat OpenShift koku-metrics-operator lets a user with edit rights on the Cost
Credential exfiltration in koku-metrics-operator allows a privileged user with edit access to the CostManagementMetricsC
Exploit-DB