This vulnerability in the koku-metrics-operator arises from the ability of a user to modify the CostManagementMetricsConfig custom resource to specify an arbitrary upload URL. Because the operator attaches the cluster-global Red Hat Cloud pull-secret bearer token to HTTP requests when authentication.type is set to token, an attacker controlling the upload URL can obtain this token. The vulnerability is classified as SSRF and has a CVSS 3.1 score of 7.6, indicating high severity. No patch or official remediation level is currently indicated in the vendor advisory, and no known exploits in the wild have been reported.

An attacker with permission to edit the CostManagementMetricsConfig custom resource can cause the operator to send HTTP requests to an attacker-controlled URL with the cluster-global Red Hat Cloud pull-secret bearer token attached. This exposure of a sensitive bearer token can lead to unauthorized access to Red Hat Cloud resources, resulting in confidentiality compromise. The integrity impact is limited, and availability is not affected.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-18378 for current remediation guidance. Until a fix is available, restrict permissions to edit the CostManagementMetricsConfig custom resource to trusted administrators only to prevent exploitation. Monitor Red Hat's official channels for updates on patches or workarounds.