Cost Management Metrics Operator
Monthly
Service-account token disclosure in the Red Hat OpenShift koku-metrics-operator lets a user with edit rights on the CostManagementMetricsConfig custom resource redirect metrics uploads to an attacker-controlled URL, to which the operator blindly attaches its own Kubernetes bearer token. This CWE-918 server-side request forgery (tagged SSRF/Kubernetes/Red Hat) yields the operator's service-account credentials, enabling in-cluster privilege escalation. Reported by Red Hat with a CVSS 3.1 base of 7.6 (scope-changed); no public exploit identified at time of analysis and it is not in CISA KEV.
Credential exfiltration in koku-metrics-operator allows a privileged user with edit access to the CostManagementMetricsConfig custom resource to redirect the operator's OAuth token requests to an attacker-controlled endpoint, exposing the tenant's Red Hat SSO client_id and client_secret. The operator's service-account authentication mode unconditionally forwards these credentials to whatever OAuth token URL is configured in the CR, acting as a confused deputy on behalf of the CR editor. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the CVSS Scope:Changed metric reflects that the operator process holds credentials inaccessible to the CR editor directly, amplifying impact beyond the initial access tier.
Bearer-token disclosure in the Red Hat koku-metrics-operator lets a user with edit rights over the CostManagementMetricsConfig custom resource redirect metric uploads to an attacker-controlled URL, causing the operator to attach the cluster-global Red Hat Cloud pull-secret token to that outbound request and leak it. Because token authentication is the default (authentication.type=token) and the pull secret is shared cluster-wide, a single privileged tenant can harvest credentials that grant access to the organization's Red Hat Cloud/console.redhat.com services. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the issue was reported directly by Red Hat's security team.
Service-account token disclosure in the Red Hat OpenShift koku-metrics-operator lets a user with edit rights on the CostManagementMetricsConfig custom resource redirect metrics uploads to an attacker-controlled URL, to which the operator blindly attaches its own Kubernetes bearer token. This CWE-918 server-side request forgery (tagged SSRF/Kubernetes/Red Hat) yields the operator's service-account credentials, enabling in-cluster privilege escalation. Reported by Red Hat with a CVSS 3.1 base of 7.6 (scope-changed); no public exploit identified at time of analysis and it is not in CISA KEV.
Credential exfiltration in koku-metrics-operator allows a privileged user with edit access to the CostManagementMetricsConfig custom resource to redirect the operator's OAuth token requests to an attacker-controlled endpoint, exposing the tenant's Red Hat SSO client_id and client_secret. The operator's service-account authentication mode unconditionally forwards these credentials to whatever OAuth token URL is configured in the CR, acting as a confused deputy on behalf of the CR editor. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the CVSS Scope:Changed metric reflects that the operator process holds credentials inaccessible to the CR editor directly, amplifying impact beyond the initial access tier.
Bearer-token disclosure in the Red Hat koku-metrics-operator lets a user with edit rights over the CostManagementMetricsConfig custom resource redirect metric uploads to an attacker-controlled URL, causing the operator to attach the cluster-global Red Hat Cloud pull-secret token to that outbound request and leak it. Because token authentication is the default (authentication.type=token) and the pull secret is shared cluster-wide, a single privileged tenant can harvest credentials that grant access to the organization's Red Hat Cloud/console.redhat.com services. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the issue was reported directly by Red Hat's security team.