CVE-2026-18381

Analyzed Analyzed - Analysis Complete

koku-metrics-operator Kubernetes Service-Account Token Exposure

Publication date: 2026-07-30

Last updated on: 2026-08-12

Assigner: redhat-SADP

Description

A flaw was found in the koku-metrics-operator for Red Hat OpenShift. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary upload URL. The operator attaches its own Kubernetes service-account bearer token to queries sent to this user-controlled URL, allowing the attacker to obtain the token.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-08-12

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-18381

EUVD

EUVD-2026-51093

Affected Vendors & Products

Vendor	Product	Version / Range
redhat	cost_management_metrics_operator	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

CVE-2026-18381 is a flaw in the koku-metrics-operator for Red Hat OpenShift. It allows a user with edit permissions on the CostManagementMetricsConfig custom resource to set an arbitrary upload URL. The operator then sends PromQL queries to this URL using its own Kubernetes service-account bearer token, which has elevated privileges to read all Secrets across the cluster.

Detection Guidance

Check for unauthorized CostManagementMetricsConfig CRs in the operator's namespace using kubectl get costmanagementmetricsconfigs -n <namespace>. Inspect CRs for suspicious service_address fields pointing to external URLs. Review Prometheus query logs for unexpected outbound connections to external endpoints.

Impact Analysis

An attacker with create or update permissions on costmanagementmetricsconfigs can exploit this to steal the operator's service-account token. This token grants access to sensitive Secrets across all namespaces, potentially exposing confidential data like credentials or API keys.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements such as GDPR (data protection) and HIPAA (health information privacy). Unauthorized access to Secrets may result in data breaches, triggering regulatory penalties and legal consequences.

Mitigation Strategies

Restrict CostManagementMetricsConfig CR permissions to only necessary users. Update the CRD to validate service_address fields to only allow in-cluster Prometheus or Thanos endpoints. Replace the BearerToken with a TokenRequest API token bound to prometheus-k8s audience to limit token scope.

Hi! I’m here to help you understand CVE-2026-18381. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70