A flaw was found in koku-metrics-operator. (CVE-2026-18378)
A vulnerability in the koku-metrics-operator allows users with permission to edit the CostManagementMetricsConfig custom resource to specify an arbitrary upload URL. When the authentication type is set to token (the default), the cluster-global Red Hat Cloud pull-secret bearer token is attached to HTTP requests sent to this user-controlled URL. This exposure enables an attacker with edit permissions to obtain the bearer token.
AI Analysis
Technical Summary
The koku-metrics-operator contains a vulnerability (CVE-2026-18378) where the CostManagementMetricsConfig custom resource can be modified by an authorized user to specify an arbitrary upload URL. If the authentication.type is set to token, the operator attaches the cluster-global Red Hat Cloud pull-secret bearer token to HTTP requests to this URL. This flaw allows an attacker with edit privileges on the custom resource to exfiltrate the bearer token, potentially compromising cluster authentication. The CVSS 3.1 vector is AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N, indicating network attack vector, low complexity, high privileges required, no user interaction, scope changed, high confidentiality impact, low integrity impact, and no availability impact.
Potential Impact
An attacker with permission to edit the CostManagementMetricsConfig custom resource can cause the operator to send the cluster-global Red Hat Cloud pull-secret bearer token to an arbitrary URL under the attacker's control. This token exposure can lead to unauthorized access to cluster resources or cloud services authenticated by the token, resulting in a high confidentiality impact. Integrity impact is low and availability is not affected.
Mitigation Recommendations
Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-18378 for current remediation guidance. Until a fix is available, restrict edit permissions on the CostManagementMetricsConfig custom resource to trusted users only to prevent unauthorized modification of the upload URL.
A flaw was found in koku-metrics-operator. (CVE-2026-18378)
Description
A vulnerability in the koku-metrics-operator allows users with permission to edit the CostManagementMetricsConfig custom resource to specify an arbitrary upload URL. When the authentication type is set to token (the default), the cluster-global Red Hat Cloud pull-secret bearer token is attached to HTTP requests sent to this user-controlled URL. This exposure enables an attacker with edit permissions to obtain the bearer token.
CVSS v3.1
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The koku-metrics-operator contains a vulnerability (CVE-2026-18378) where the CostManagementMetricsConfig custom resource can be modified by an authorized user to specify an arbitrary upload URL. If the authentication.type is set to token, the operator attaches the cluster-global Red Hat Cloud pull-secret bearer token to HTTP requests to this URL. This flaw allows an attacker with edit privileges on the custom resource to exfiltrate the bearer token, potentially compromising cluster authentication. The CVSS 3.1 vector is AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N, indicating network attack vector, low complexity, high privileges required, no user interaction, scope changed, high confidentiality impact, low integrity impact, and no availability impact.
Potential Impact
An attacker with permission to edit the CostManagementMetricsConfig custom resource can cause the operator to send the cluster-global Red Hat Cloud pull-secret bearer token to an arbitrary URL under the attacker's control. This token exposure can lead to unauthorized access to cluster resources or cloud services authenticated by the token, resulting in a high confidentiality impact. Integrity impact is low and availability is not affected.
Mitigation Recommendations
Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-18378 for current remediation guidance. Until a fix is available, restrict edit permissions on the CostManagementMetricsConfig custom resource to trusted users only to prevent unauthorized modification of the upload URL.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-8jfr-h5wv-8vhv
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-18378"]
- Ecosystems
- []
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6a6b72b19c2644c7f84723aa
Added to database: 07/30/2026, 15:50:09 UTC
Last enriched: 07/30/2026, 20:22:13 UTC
Last updated: 07/31/2026, 02:51:54 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.