CVE-2026-18378

Analyzed Analyzed - Analysis Complete

koku-metrics-operator Token Exposure via Arbitrary Upload URL

Publication date: 2026-07-30

Last updated on: 2026-08-17

Assigner: redhat-SADP

Description

A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows user able to edit the CR to specify an arbitrary upload URL. When authentication.type is set to token (the default), the cluster-global Red Hat Cloud pull-secret bearer token is attached to HTTP requests sent to this user-controlled URL, allowing the attacker to obtain the token.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-08-17

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-18378

EUVD

EUVD-2026-51094

Affected Vendors & Products

Vendor	Product	Version / Range
redhat	cost_management_metrics_operator	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

This vulnerability is a Server-Side Request Forgery (SSRF) and confused deputy attack in the koku-metrics-operator. It allows a user with permissions to edit the CostManagementMetricsConfig custom resource to set an arbitrary upload URL. When authentication is set to token (default), the operator attaches the cluster's Red Hat Cloud pull-secret bearer token to HTTP requests sent to this user-controlled URL, potentially exposing the token.

Detection Guidance

Check for unauthorized outbound HTTP requests from the koku-metrics-operator namespace. Inspect CostManagementMetricsConfig CRs for modified api_url fields pointing to unexpected endpoints. Review logs for POST requests containing the cluster's pull-secret token.

Impact Analysis

An attacker with create/update permissions on costmanagementmetricsconfigs could exfiltrate the cluster's Red Hat Cloud pull-secret token. This token authenticates the entire cluster to Red Hat services like console.redhat.com and registry.redhat.io, potentially leading to unauthorized access or data breaches.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements under GDPR, HIPAA, or other regulations. Exposure of authentication tokens may result in data breaches, unauthorized data access, or integrity violations, requiring mandatory breach notifications and potential fines.

Mitigation Strategies

Revoke the exposed pull-secret token immediately. Update the CostManagementMetricsConfig CRD to enforce api_url validation against the default console.redhat.com endpoint. Restrict permissions for costmanagementmetricsconfigs to least privilege.

Hi! I’m here to help you understand CVE-2026-18378. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70