EUVD-2026-51095
GHSA-3f36-c5m8-4frw
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
PR:H required to edit the CR; S:C because the operator acts as a confused deputy forwarding credentials the CR editor cannot access directly; no integrity or availability impact applies.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
1DescriptionCVE.org
A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary OAuth token endpoint. When authentication.type is set to service-account, the operator sends the tenant's Red Hat SSO client_id and client_secret to this user-controlled URL, allowing the attacker to obtain the credentials.
AnalysisAI
Credential exfiltration in koku-metrics-operator allows a privileged user with edit access to the CostManagementMetricsConfig custom resource to redirect the operator's OAuth token requests to an attacker-controlled endpoint, exposing the tenant's Red Hat SSO client_id and client_secret. The operator's service-account authentication mode unconditionally forwards these credentials to whatever OAuth token URL is configured in the CR, acting as a confused deputy on behalf of the CR editor. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the CVSS Scope:Changed metric reflects that the operator process holds credentials inaccessible to the CR editor directly, amplifying impact beyond the initial access tier.
Technical ContextAI
koku-metrics-operator is a Kubernetes operator deployed in OpenShift clusters that reconciles the CostManagementMetricsConfig custom resource (CR) to facilitate cloud cost reporting through Red Hat's cost management service. When authentication.type is set to service-account, the operator implements OAuth client-credentials flow, constructing an HTTP POST to a configurable token endpoint and including the tenant's client_id and client_secret. CWE-918 (Server-Side Request Forgery) applies precisely here: the operator trusts a user-supplied URL embedded in the CR and makes outbound requests on behalf of the cluster, carrying secrets that the CR editor would not otherwise have direct access to. The absence of URL allowlisting or validation in the CR reconciliation loop is the root cause - the operator is weaponized as a credential-forwarding proxy by anyone who can write to the CR.
RemediationAI
The primary remediation is to apply the vendor-released patch from Red Hat once published; monitor https://access.redhat.com/security/cve/CVE-2026-18382 for the patched operator version and upgrade instructions, as no specific fix version was confirmed in the available intelligence. Until a patch is available, two compensating controls are recommended. First, audit and restrict Kubernetes RBAC immediately: run 'kubectl get rolebindings,clusterrolebindings -A -o yaml | grep CostManagementMetricsConfig' to enumerate who currently holds edit or patch rights on these CRs, and remove access from any non-admin principals - trade-off is potential disruption to delegated cost management workflows. Second, enforce network egress policy on the operator's pod namespace to permit outbound traffic only to known Red Hat SSO endpoints (e.g., sso.redhat.com), preventing the operator from reaching an attacker-controlled URL even if the CR is tampered - test thoroughly before production deployment, as overly broad egress blocks may disrupt legitimate cost-reporting telemetry.
Service-account token disclosure in the Red Hat OpenShift koku-metrics-operator lets a user with edit rights on the Cost
Bearer-token disclosure in the Red Hat koku-metrics-operator lets a user with edit rights over the CostManagementMetrics
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today