EUVD-2026-51093
GHSA-wfh6-5fvj-2qcg
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N
Requires existing edit rights on the CR (PR:L) but low complexity; stolen operator token crosses a security boundary (S:C) with high confidentiality disclosure and no direct integrity/availability impact.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in the koku-metrics-operator for Red Hat OpenShift. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary upload URL. The operator attaches its own Kubernetes service-account bearer token to queries sent to this user-controlled URL, allowing the attacker to obtain the token.
Articles & Coverage 1
AnalysisAI
Service-account token disclosure in the Red Hat OpenShift koku-metrics-operator lets a user with edit rights on the CostManagementMetricsConfig custom resource redirect metrics uploads to an attacker-controlled URL, to which the operator blindly attaches its own Kubernetes bearer token. This CWE-918 server-side request forgery (tagged SSRF/Kubernetes/Red Hat) yields the operator's service-account credentials, enabling in-cluster privilege escalation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker already possess RBAC permission to edit (patch/update) the koku-metrics-operator's CostManagementMetricsConfig custom resource on an OpenShift cluster where the operator is installed and periodically uploading metrics; the concrete trigger is setting the CR's upload URL field to an attacker-controlled endpoint. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N scores 7.6 (High), driven by low attack complexity, a changed scope (the stolen operator token grants authority beyond the vulnerable component), and high confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A developer or compromised service account that holds edit rights on the CostManagementMetricsConfig CR in an OpenShift cluster changes the upload URL to a listener they control. On the next scheduled upload the operator connects out and attaches its Kubernetes service-account bearer token, which the attacker captures and replays against the Kubernetes API to act with the operator's privileges. … |
| Remediation | No vendor-released patch version was identified in the provided data, so consult the Red Hat advisory (https://access.redhat.com/security/cve/CVE-2026-18381) and Bugzilla 2509251 (https://bugzilla.redhat.com/show_bug.cgi?id=2509251) for the fixed operator build and upgrade to it once published. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all OpenShift environments running koku-metrics-operator and audit RBAC permissions on CostManagementMetricsConfig custom resources to restrict edit access to only essential accounts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Kubernetes
View allA critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Rated critical severity (CVSS 9.9), this vulne
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can
Kyverno Kubernetes policy engine prior to 1.x has a privilege escalation vulnerability (CVSS 9.9) allowing policy bypass
Kamaji is the Hosted Control Plane Manager for Kubernetes. Rated critical severity (CVSS 9.9), this vulnerability is rem
Jumpserver is a popular open source bastion host, and Koko is a Jumpserver component that is the Go version of coco, ref
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today