CVE-2026-18382

The CVSS 6.8 score for CVE-2026-18382 likely understates the real risk. The koku-metrics-operator for OpenShift Cost Management accepts user-supplied OAuth endpoint URLs in the CostManagementMetricsConfig CustomResource, allowing an attacker with CR edit permissions to redirect credential handoff to an attacker-controlled server and exfiltrate the client_id and client_secret. The CVSS treats these as generic secrets, but the actual severity depends entirely on what those Red Hat SSO credentials unlock. If they provide access beyond this operator's function—cross-tenant cost data, billing APIs, or broader SSO integration—then the impact could be orders of magnitude worse than 6.8 suggests. Check your environment: identify who can edit CostManagementMetricsConfig. In many OpenShift clusters, this includes service accounts with namespace-level permissions or users holding monitoring roles—not just admins. That's your attack surface. Before patching, determine the actual privilege scope of the provisioned SSO client. Contact your identity team or review the OAuth client configuration in the Red Hat SSO realm. If the credentials are overprivileged for cost reporting alone, the blast radius extends well beyond this operator. The remediation has two layers. First, patch the operator when available—this removes the arbitrary URL acceptance. Second, verify credential rotation capability. If these client_id/secret pairs can't be rotated without breaking cost management integrations, you have a structural risk: the operator design lets you exfiltrate credentials you cannot easily revoke. In that case, coordinate with the identity provider to scope down the OAuth client to least-privilege before any patching cycle. Network policies do not help here—this is an intentional credential transmission to a user-specified endpoint, not a lateral movement scenario. The control that bounds risk is credential design, not network segmentation.

Reviewed through automated stages and approved by a human before publication.