The Custom Metrics Autoscaler Operator for Red Hat OpenShift allows scaling workloads using additional metrics beyond pod metrics and is based on KEDA 2.18.1. Two vulnerabilities, CVE-2025-68156 and CVE-2025-68476, have been identified affecting this operator. These vulnerabilities involve resource allocation without proper limits (CWE-770) and path traversal issues (CWE-22). Red Hat has issued an update (version 2.18.1-2) with new container images and operator bundles to address these issues. The advisory does not explicitly state that a fix is included but provides updated images and recommends applying this update after ensuring all previous errata are applied. No known exploits are reported in the wild.

The vulnerabilities could potentially allow improper resource allocation or unauthorized file path access within the Custom Metrics Autoscaler Operator, which may lead to denial of service or unauthorized access scenarios. However, no active exploitation has been reported. The high severity rating indicates significant potential impact if exploited.

Red Hat recommends applying the update to Custom Metrics Autoscaler Operator version 2.18.1-2, ensuring all previously released errata relevant to the system are applied beforehand. Users should refer to the official Red Hat advisory and update instructions at https://access.redhat.com/articles/11258. Since no explicit fix details are provided, checking the vendor advisory for the latest remediation status is advised. There are no indications that no action is required or that the issue is already mitigated.