The Red Hat Cost Management Metrics Operator, a component of the Red Hat Cost Management service for OpenShift, collects usage data by querying Prometheus and uploading metrics to console.redhat.com. Multiple security vulnerabilities (CVE-2025-11187 and 14 others) primarily in OpenSSL affect Red Hat Enterprise Linux 10 and related components. These vulnerabilities include arbitrary code execution via crafted PKCS#12 files, denial of service through various malformed inputs, information disclosure, and data integrity bypass. Red Hat has issued security advisories RHSA-2026:1472 and RHSA-2026:3228 detailing these issues and providing updated packages. The Cost Management Metrics Operator has a version 4.3.1 update available. The vendor advisory does not indicate known exploits in the wild and provides detailed remediation instructions.

The vulnerabilities can lead to arbitrary code execution, denial of service, information disclosure, and data integrity bypass on affected systems running Red Hat Enterprise Linux 10 and the Cost Management Metrics Operator. Exploitation could compromise system stability and security, potentially allowing attackers to execute malicious code or disrupt services. No known active exploits have been reported at this time.

Red Hat has released updated OpenSSL packages and Cost Management Metrics Operator version 4.3.1 that address these vulnerabilities. Users should apply all relevant Red Hat errata and update to the latest versions as per the official Red Hat guidance. Detailed update instructions are available at https://docs.openshift.com/container-platform/latest/operators/admin/olm-upgrading-operators.html and https://access.redhat.com/articles/11258. No additional mitigations are indicated by the vendor advisory.