The koku-metrics-operator contains a vulnerability (CVE-2026-18382) where the CostManagementMetricsConfig custom resource permits a user with edit rights to specify an arbitrary OAuth token endpoint. If the authentication.type is configured as service-account, the operator transmits the tenant's Red Hat SSO client_id and client_secret to the user-controlled endpoint. This flaw enables an attacker with sufficient privileges to obtain these credentials, potentially compromising authentication security. The vulnerability is categorized under CWE-918 (Server-Side Request Forgery).

An attacker with permission to edit the CostManagementMetricsConfig custom resource can cause the operator to send sensitive Red Hat SSO client credentials to an arbitrary endpoint controlled by the attacker. This leads to credential disclosure, which can compromise tenant authentication and potentially allow unauthorized access to protected resources. The vulnerability does not impact integrity or availability directly but has a high confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided in the advisory content. Until a fix is available, restrict edit permissions on the CostManagementMetricsConfig custom resource to trusted users only to prevent exploitation.