CVE-2026-18378

Published: Jul 30, 2026Modified: Aug 17, 2026

6.8

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Exploitability: 2.3 / Impact: 4.0

Source: NVD

Description

A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows user able to edit the CR to specify an arbitrary upload URL. When authentication.type is set to token (the default), the cluster-global Red Hat Cloud pull-secret bearer token is attached to HTTP requests sent to this user-controlled URL, allowing the attacker to obtain the token.

Affected (1)

Products: Redhat: Cost Management Metrics Operator

1 product

Cost Management Metrics Operator

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Redhat Cost Management Metrics Operator	All versions

Related CWEs

Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (2)

https://access.redhat.com/security/cve/CVE-2026-18378

Source: secalert@redhat.com

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2509249

Source: secalert@redhat.com

Issue TrackingMitigationVendor Advisory

Timeline

No history available yet.