EUVD-2026-51094
GHSA-8jfr-h5wv-8vhv
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
PR:H because the attacker must already have RBAC to edit the CR; AV:N/S:C/C:H reflect network exfiltration of a cluster-global token affecting an external system; no integrity/availability impact.
Primary rating from Vendor (redhat).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows user able to edit the CR to specify an arbitrary upload URL. When authentication.type is set to token (the default), the cluster-global Red Hat Cloud pull-secret bearer token is attached to HTTP requests sent to this user-controlled URL, allowing the attacker to obtain the token.
AnalysisAI
Bearer-token disclosure in the Red Hat koku-metrics-operator lets a user with edit rights over the CostManagementMetricsConfig custom resource redirect metric uploads to an attacker-controlled URL, causing the operator to attach the cluster-global Red Hat Cloud pull-secret token to that outbound request and leak it. Because token authentication is the default (authentication.type=token) and the pull secret is shared cluster-wide, a single privileged tenant can harvest credentials that grant access to the organization's Red Hat Cloud/console.redhat.com services. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the issue was reported directly by Red Hat's security team.
Technical ContextAI
The koku-metrics-operator is an OpenShift/Kubernetes operator that collects cluster cost-management metrics and periodically uploads them to Red Hat Cloud (cost management / console.redhat.com), authenticating with the cluster's global Red Hat Cloud pull-secret bearer token. The flaw is a classic Server-Side Request Forgery (CWE-918): the upload destination is taken from the user-editable CostManagementMetricsConfig CR without restricting it to trusted Red Hat endpoints, so the operator will faithfully send its bearer token to whatever host the CR names. The root cause is that the secret is bound to the request rather than to a validated, allow-listed destination, turning a data-egress feature into a credential-exfiltration primitive.
RemediationAI
No vendor-released patched version is identified in the available data, so track https://access.redhat.com/security/cve/CVE-2026-18378 and Bugzilla 2509249 for the fixed operator build and upgrade to it once published. As immediate compensating controls: tightly restrict RBAC so that only trusted cluster/namespace administrators can create or edit CostManagementMetricsConfig resources (this directly removes the PR:H prerequisite the attack depends on, at the cost of centralizing config changes); where feasible, switch authentication.type from the default token to service-account/basic credentials scoped to the intended endpoint rather than the cluster-global pull secret so the shared token is never attached; and enforce egress network policy so the operator can only reach legitimate Red Hat Cloud upload hosts (console.redhat.com), which neutralizes exfiltration to arbitrary URLs but will break uploads if the destination changes. Rotate the Red Hat Cloud pull secret if you suspect the CR was tampered with.
Service-account token disclosure in the Red Hat OpenShift koku-metrics-operator lets a user with edit rights on the Cost
Credential exfiltration in koku-metrics-operator allows a privileged user with edit access to the CostManagementMetricsC
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today