What is the CVSS score of CVE-2026-18381?

CVE-2026-18381 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of koku-metrics-operator are affected by CVE-2026-18381?

Red Hat OpenShift's koku-metrics-operator contains a service-account token disclosure vulnerability that allows edit-privileged users to redirect metrics uploads to attacker-controlled servers and…

How to fix or mitigate CVE-2026-18381?

Within 24 hours, inventory all OpenShift environments running koku-metrics-operator and audit RBAC permissions on CostManagementMetricsConfig custom resources to restrict edit access to only essential accounts. Within 7 days, implement network egress policies to limit the operator's outbound connectivity, execute service-account credential rotation for the metrics-operator account, and document the rotation procedure for future remediation. Within 30 days, establish a patch readiness plan with Red Hat support, conduct upgrade testing in non-production OpenShift clusters, and schedule coordinated deployment once a patch is released.

koku-metrics-operator CVE-2026-18381

EUVD-2026-51093 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-07-30 secalert@redhat.com

GHSA-wfh6-5fvj-2qcg

Kubernetes SSRF Red Hat Cost Management Metrics Operator

7.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.6 HIGH

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N

vuln.today AI

7.7 HIGH

Requires existing edit rights on the CR (PR:L) but low complexity; stolen operator token crosses a security boundary (S:C) with high confidentiality disclosure and no direct integrity/availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Red Hat

7.6 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 12:31 vuln.today

CVE Published

Jul 30, 2026 - 12:17 nvd

HIGH 7.6

DescriptionNVD

A flaw was found in the koku-metrics-operator for Red Hat OpenShift. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary upload URL. The operator attaches its own Kubernetes service-account bearer token to queries sent to this user-controlled URL, allowing the attacker to obtain the token.

Articles & Coverage 1

News 3 New Kubernetes Vulnerabilities - 3 High Severity Jul 31, 2026

AnalysisAI

Service-account token disclosure in the Red Hat OpenShift koku-metrics-operator lets a user with edit rights on the CostManagementMetricsConfig custom resource redirect metrics uploads to an attacker-controlled URL, to which the operator blindly attaches its own Kubernetes bearer token. This CWE-918 server-side request forgery (tagged SSRF/Kubernetes/Red Hat) yields the operator's service-account credentials, enabling in-cluster privilege escalation. Reported by Red Hat with a CVSS 3.1 base of 7.6 (scope-changed); no public exploit identified at time of analysis and it is not in CISA KEV.

Technical ContextAI

The koku-metrics-operator is a Kubernetes Operator running on Red Hat OpenShift that collects OpenShift usage/cost metrics and uploads them to Red Hat's cost-management (Koku/Cost Management) ingress service. Its behavior is driven by the CostManagementMetricsConfig custom resource, which exposes the destination upload endpoint as an operator-controlled setting. The root cause is CWE-918 (Server-Side Request Forgery): the operator treats the CR's upload URL as trusted and outbound requests to that URL carry the operator's mounted Kubernetes service-account bearer token in the Authorization header. Because there is no allowlist or validation restricting the URL to Red Hat's ingress endpoints, any principal with write access to the CR can coerce the operator into sending its credential to an arbitrary host. No CPE strings were provided in the input, so exact affected versions must be confirmed via the Red Hat advisory.

RemediationAI

No vendor-released patch version was identified in the provided data, so consult the Red Hat advisory (https://access.redhat.com/security/cve/CVE-2026-18381) and Bugzilla 2509251 (https://bugzilla.redhat.com/show_bug.cgi?id=2509251) for the fixed operator build and upgrade to it once published. As immediate compensating controls, tighten RBAC so that only trusted cluster administrators can create or edit CostManagementMetricsConfig resources - audit and revoke edit/patch verbs on this CRD from namespace users, service accounts, and CI pipelines (trade-off: legitimate operators managing cost-metrics config lose self-service and must route changes through admins). Additionally, restrict the operator's egress with a NetworkPolicy or egress firewall that only permits connections to Red Hat's cost-management ingress hosts (trade-off: any change to legitimate upstream endpoints requires policy updates), and monitor operator outbound traffic and CR modifications for unexpected upload URLs. If the operator is not actively used, uninstall it to eliminate the exposed token.