CVE-2026-18381

The CVSS 7.6 rating for this vulnerability in the koku-metrics-operator obscures the real danger: this is a service-account token exfiltration vector, not merely a misconfigured URL. The CostManagementMetricsConfig custom resource allows an attacker with CR edit permissions to specify an arbitrary destination for metrics uploads. The operator then sends its service-account token along with every outbound request to that destination. What you think of as a configuration gap is actually a credential-harvesting mechanism. The severity of this vulnerability is entirely dependent on what permissions the koku-metrics-operator's service account holds. In typical OpenShift deployments where cost-management operators need broad cluster access to collect resource usage data, this collapses the privilege boundary from 'can edit one CR' to 'potentially full cluster compromise.' The EPSS of 0.00197 is misleading—it reflects the fact that exploitation requires CR edit permissions, not that exploitation is difficult once an attacker has that foothold. In practice, this vulnerability targets malicious insiders, compromised developer accounts, or supply-chain compromises of CI/CD pipelines that have CR edit rights. What you should do: First, examine the operator's ClusterRole and RoleBinding definitions to determine the actual permission scope of its service account. If the service account has cluster-admin or broad secrets/read permissions, the exfiltrated token grants significant access. Second, check whether the operator's outbound HTTP client attaches the service account token to requests by default—many Kubernetes client libraries do this automatically. The fix matters: if the remediation only added URL allowlisting without disabling token attachment to outbound requests, the underlying credential exfiltration vector remains. Third, audit other operators in your cluster for the same pattern—user-controllable outbound destinations paired with high-privilege service accounts are more common than you'd think. The deeper pattern here is operator-side credential exfiltration: the operator makes an outbound HTTP call, the destination is user-influenced, and the credentials travel with the request. This is not a novel vulnerability class, but each instance's severity depends on the specific operator's RBAC scope. Treat this as a opportunity to review all operators with outbound connectivity and apply least-privilege principles to their service accounts.

Reviewed through automated stages and approved by a human before publication.