CVE-2026-18382

Published: Jul 30, 2026Modified: Aug 12, 2026

6.8

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Exploitability: 2.3 / Impact: 4.0

Source: secalert@redhat.com (Secondary)

Description

A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary OAuth token endpoint. When authentication.type is set to service-account, the operator sends the tenant's Red Hat SSO client_id and client_secret to this user-controlled URL, allowing the attacker to obtain the credentials.

Affected (1)

Products: Redhat: Cost Management Metrics Operator

1 product

Cost Management Metrics Operator

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Redhat Cost Management Metrics Operator	All versions

Related CWEs

Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (2)

https://access.redhat.com/security/cve/CVE-2026-18382

Source: secalert@redhat.com

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2509253

Source: secalert@redhat.com

Issue TrackingMitigationVendor Advisory

Timeline

No history available yet.