koku-metrics-operator EUVD-2026-51095

Exploitation requires the attacker to hold Kubernetes RBAC permissions sufficient to create or update a CostManagementMetricsConfig custom resource in a namespace where koku-metrics-operator is active - this high-privilege prerequisite is mapped to CVSS PR:H and is the primary limiting factor. Additionally, the CostManagementMetricsConfig CR must have authentication.type set to service-account, either pre-existing in the cluster or writable by the attacker after gaining CR edit access. The attacker must control or observe a server reachable from the operator pod's network egress path to receive the forwarded credentials. Exploitation is bounded by: (1) deployments where Red Hat cost management integration via koku-metrics-operator is active; (2) absence of network egress restrictions on the operator pod; (3) RBAC configurations that grant CostManagementMetricsConfig edit or patch rights to non-admin principals. Default OpenShift RBAC confines these rights to cluster-admin, meaning exploitation in hardened environments requires prior privilege escalation or insider access.

The CVSS 6.8 score with vector AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N reflects a realistic threat model. The High-privilege prerequisite (PR:H) is the primary mitigating factor - the attacker must hold Kubernetes RBAC rights to edit or patch CostManagementMetricsConfig resources, which in standard OpenShift deployments is restricted to cluster-admin roles. This limits the realistic threat to insider threats, compromised administrator accounts, or misconfigured namespace RBAC. The Scope:Changed and Confidentiality:High metrics are accurate: the operator process carries Red Hat SSO credentials that the attacker could not otherwise access, and their exfiltration enables downstream authentication impersonation. No EPSS data was provided, KEV status is absent, and no POC is referenced - real-world exploitation probability is unconfirmed from available intelligence. SSRF with credential forwarding in Kubernetes operators is a well-understood attack class, making exploitation technically straightforward once the privilege prerequisite is satisfied. The attack is not automatable at scale due to the PR:H requirement.

An attacker holding Kubernetes RBAC edit rights on the CostManagementMetricsConfig CR - obtained through a compromised developer account or a misconfigured namespace policy - modifies the OAuth token endpoint field to point to an attacker-controlled HTTPS server and ensures authentication.type is set to service-account. The next time the koku-metrics-operator reconciles the CR, it performs an HTTP POST to the attacker's endpoint, including the tenant's Red Hat SSO client_id and client_secret in the request body. The attacker extracts the credentials from the inbound log, then authenticates directly against Red Hat SSO to access cloud cost management APIs or enumerate tenancy billing data.