CVE-2026-18378

A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows user able to edit the CR to specify an arbitrary upload URL. When authentication.type is set to token (the default), the cluster-global Red Hat Cloud pull-secret bearer token is attached to HTTP requests sent to this user-controlled URL, allowing the attacker to obtain the token.

CVSS v3 7.6 HIGH

7.6^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.3 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://access.redhat.com/errata/RHSA-2026:81201
https://access.redhat.com/security/cve/CVE-2026-18378	Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2509249	Issue Tracking Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:redhat:cost_management_metrics_operator:-:*:*:*:*:openshift:*:*

History

23 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Se encontró una vulnerabilidad en koku-metrics-operator. El recurso personalizado CostManagementMetricsConfig del operador permite al usuario con capacidad de editar el CR especificar una URL de carga arbitraria. Cuando autenticación.type se establece en token (el valor predeterminado), el token portador pull-secret de Red Hat Cloud global del clúster se adjunta a las solicitudes HTTP enviadas a esta URL controlada por el usuario, permitiendo al atacante obtener el token.

12 Oct 2026, 21:17

Type	Values Removed	Values Added
References		() https://access.redhat.com/errata/RHSA-2026:81201 -

Information

Published : 2026-07-30 12:17

Updated : 2026-10-23 22:10

NVD link : CVE-2026-18378

Mitre link : CVE-2026-18378

CVE.ORG link : CVE-2026-18378

JSON object : View

Products Affected

redhat

cost_management_metrics_operator

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2026-18378", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-18378", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-31T22:48:52.882288Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 4.7, "exploitabilityScore": 2.3}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 2.3}]}, "affected": [{"source": "secalert@redhat.com", "affectedData": [{"cpes": ["cpe:/a:redhat:cost_management:4::el9"], "vendor": "Red Hat", "product": "Cost Management 4", "versions": [{"status": "unaffected", "version": "1790844333", "lessThan": "*", "versionType": "rpm"}], "packageName": "costmanagement/costmanagement-metrics-rhel9-operator", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}]}], "published": "2026-07-30T12:17:27.553", "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:81201", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-18378", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509249", "tags": ["Issue Tracking", "Mitigation", "Vendor Advisory"], "source": "secalert@redhat.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows user able to edit the CR to specify an arbitrary upload URL. When authentication.type is set to token (the default), the cluster-global Red Hat Cloud pull-secret bearer token is attached to HTTP requests sent to this user-controlled URL, allowing the attacker to obtain the token."}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad en koku-metrics-operator. El recurso personalizado CostManagementMetricsConfig del operador permite al usuario con capacidad de editar el CR especificar una URL de carga arbitraria. Cuando autenticaci\u00f3n.type se establece en token (el valor predeterminado), el token portador pull-secret de Red Hat Cloud global del cl\u00faster se adjunta a las solicitudes HTTP enviadas a esta URL controlada por el usuario, permitiendo al atacante obtener el token."}], "lastModified": "2026-10-23T22:10:00.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:cost_management_metrics_operator:-:*:*:*:*:openshift:*:*", "vulnerable": true, "matchCriteriaId": "986E843B-6166-4A3A-906F-C841852C9CE6"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}