koku-metrics-operator CVE-2026-18381

Exploitation requires that the attacker already possess RBAC permission to edit (patch/update) the koku-metrics-operator's CostManagementMetricsConfig custom resource on an OpenShift cluster where the operator is installed and periodically uploading metrics; the concrete trigger is setting the CR's upload URL field to an attacker-controlled endpoint. The operator must reach that URL with outbound network connectivity and must be configured to attach its service-account bearer token to the request (its default upload behavior). Limiting factors: this is not remote-unauthenticated - it needs existing in-cluster write privileges on the CR (PR:H), the operator must be deployed and running its upload cycle, and egress from the operator to the attacker host must be permitted; NetworkPolicy egress restrictions or removal of edit rights on the CR each break the chain.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N scores 7.6 (High), driven by low attack complexity, a changed scope (the stolen operator token grants authority beyond the vulnerable component), and high confidentiality impact. The critical limiter is PR:H - the attacker must already hold RBAC write/edit permission on the CostManagementMetricsConfig CR, so this is an authenticated, privilege-dependent flaw rather than an anonymous internet-facing bug. No EPSS score, SSVC decision, or POC indicator was supplied, and the CVE is not listed in CISA KEV, so there is no evidence of active exploitation; treat this as a real but conditional insider/lateral-movement escalation risk rather than a mass-exploitation emergency. The 'S:C' and CWE-918 classification are consistent with the described token-theft-to-impersonation pathway. Note a nuance: AV:N reflects that the exfiltration destination is a network URL, but the actual precondition (editing a cluster CR) requires existing cluster access - defenders should weight the PR:H gate heavily.

A developer or compromised service account that holds edit rights on the CostManagementMetricsConfig CR in an OpenShift cluster changes the upload URL to a listener they control. On the next scheduled upload the operator connects out and attaches its Kubernetes service-account bearer token, which the attacker captures and replays against the Kubernetes API to act with the operator's privileges. No public exploit code was identified, but the technique requires only a single CR edit and a web listener, so exploitation is low-complexity for anyone already inside the cluster.