This vulnerability in the koku-metrics-operator component of Red Hat's Cost Management Metrics Operator arises from insufficient validation of the OAuth token endpoint URL in the CostManagementMetricsConfig custom resource. An authorized user able to edit this resource can specify an arbitrary URL for the OAuth token endpoint. When the authentication.type is service-account, the operator sends the tenant's Red Hat SSO client_id and client_secret to the attacker-controlled endpoint, enabling credential theft. The vulnerability is classified as Server-Side Request Forgery (SSRF) with a medium severity CVSS score of 6.8 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N). There is no vendor advisory content indicating a patch or remediation status, and no known exploits in the wild have been reported as of the publication date.

An attacker with permission to edit the CostManagementMetricsConfig custom resource can cause the operator to send sensitive Red Hat SSO client credentials (client_id and client_secret) to an arbitrary URL controlled by the attacker. This leads to credential disclosure with potential impact on confidentiality. The vulnerability does not affect integrity or availability directly. The scope is changed (S:C) indicating that the vulnerability affects resources beyond the initially vulnerable component.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-18382 for current remediation guidance. Until an official fix is available, restrict permissions to edit the CostManagementMetricsConfig custom resource to trusted users only to prevent exploitation. Monitor Red Hat's advisory for updates on patches or official mitigations.