CVE-2026-18381 describes a flaw in the koku-metrics-operator for Red Hat OpenShift where the CostManagementMetricsConfig custom resource permits an authorized user to set an arbitrary upload URL. The operator then includes its own Kubernetes service-account bearer token in queries to this URL, enabling the user to obtain the token. This vulnerability is categorized under CWE-918 (Server-Side Request Forgery) and has a CVSS 3.1 vector of AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N, indicating network attack vector, low attack complexity, high privileges required, no user interaction, scope changed, high confidentiality impact, low integrity impact, and no availability impact.

An attacker with edit permissions on the CostManagementMetricsConfig custom resource can cause the operator to send its Kubernetes service-account bearer token to an arbitrary URL controlled by the attacker. This token compromise can lead to elevated access within the cluster, potentially allowing the attacker to access or manipulate sensitive cluster resources. The vulnerability impacts confidentiality severely, with limited impact on integrity and no impact on availability.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-18381 for current remediation guidance. Until an official fix is available, restrict edit permissions on the CostManagementMetricsConfig custom resource to trusted users only to reduce the risk of exploitation.