What’s Vulnerable › Vulnerabilities

CVE-2026-18382: Project-koku/koku-metrics-operator: koku-metrics-operator: service-account client credentials sent to user-controlled token_url

• Severity: medium (CVSS 6.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-30 · updated 2026-10-23
• Weakness: CWE-918

Description

A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary OAuth token endpoint. When authentication.type is set to service-account, the operator sends the tenant's Red Hat SSO client_id and client_secret to this user-controlled URL, allowing the attacker to obtain the credentials.

Affected products

• Red Hat Cost Management 4: all versions

References

• https://access.redhat.com/errata/RHSA-2026:81201
• https://access.redhat.com/security/cve/CVE-2026-18382
• https://bugzilla.redhat.com/show_bug.cgi?id=2509253

Get alerted when CVE-2026-18382 or the next vulnerability affects your stack