The vulnerability exists in the koku-metrics-operator component of Red Hat's Cost Management Metrics Operator. The operator's custom resource CostManagementMetricsConfig permits users to specify an arbitrary upload URL. If the authentication.type is set to token, the operator attaches the cluster-global Red Hat Cloud pull-secret bearer token to HTTP requests sent to the specified URL. This behavior allows an attacker with permission to edit the custom resource to exfiltrate the bearer token via SSRF, effectively bypassing access controls and potentially gaining unauthorized access to protected resources. The vulnerability is tracked as CWE-918 (Server-Side Request Forgery).

An attacker with the ability to edit the CostManagementMetricsConfig custom resource can cause the operator to send HTTP requests to attacker-controlled URLs with the cluster-global Red Hat Cloud pull-secret bearer token attached. This leads to a confidentiality breach of the bearer token, which could be used to access protected Red Hat Cloud resources. The integrity impact is low, and availability is not affected. The vulnerability requires high privileges to exploit (editing the custom resource) and does not require user interaction.

The vendor advisory does not explicitly state that a fix is currently available, nor does it provide patch links. Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-18378 for current remediation guidance. Until a fix is available, restrict permissions to edit the CostManagementMetricsConfig custom resource to trusted administrators only to prevent exploitation.