CVE-2026-18378: Project-koku/koku-metrics-operator: koku-metrics-operator: cluster pull-secret token exfiltration via user-controlled api_url (ssrf / confused deputy)
Summary
The koku-metrics-operator CostManagementMetricsConfig CRD exposes spec.apiurl as a free-form string with no host allow-list or schema validation. When spec.authentication.type == token (the default), the operator reads the cluster-global openshift-config/pull-secret, extracts the cloud.openshift.com bearer token, and attaches it as Authorization: Bearer <token> on an outbound POST to the user-supplied URL. No comparison against the default https://console.redhat.com gates credential attachment.
Impact
A principal with create/update permission on costmanagementmetricsconfigs in the operator namespace can cause the operator to send the cluster's Red Hat Cloud / registry pull-secret bearer token to an arbitrary external or in-cluster endpoint. This credential authenticates the entire cluster to console.redhat.com and registry.redhat.io.
Affected Code
- api/v1beta1/metricsconfigtypes.go:249 — APIURL field definition (no validation) - internal/controller/costmanagementmetricsconfigcontroller.go:128,235,258,590 — credential extraction and URL construction - internal/crhchttp/httpclouddotredhat.go:94 — bearer token attachment to HTTP request
Remediation
Reject token authentication when apiurl != DefaultAPIURL. Add a CEL validation rule on the CRD:
yaml x-kubernetes-validations: - rule: "self.authentication.type != 'token' || self.apiurl == 'https://console.redhat.com'" message: "token authentication is only permitted against https://console.redhat.com"
Or implement the check in the reconciler before calling Upload().
Other sources
A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows user able to edit the CR to specify an arbitrary upload URL. When authentication.type is set to token (the default), the cluster-global Red Hat Cloud pull-secret bearer token is attached to HTTP requests sent to this user-controlled URL, allowing the attacker to obtain the token.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Add a CEL validation rule to the CostManagementMetricsConfig CRD to ensure token authentication is only permitted when spec.api_url equals https://console.redhat.com (i.e., reject token auth when self.authentication.type == 'token' and self.api_url is not the default).
CostManagementMetricsConfig CRD (koku-metrics-operator) x-kubernetes-validations (CEL rule) = self.authentication.type != 'token' || self.api_url == 'https://console.redhat.com'
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18378?
The severity of CVE-2026-18378 is high with a score of 7.6.
How does CVE-2026-18378 exploit occur?
CVE-2026-18378 exploits occur through SSRF vulnerabilities in the koku-metrics-operator that allow exfiltration of the cluster pull-secret token via a user-controlled api_url.
What systems are affected by CVE-2026-18378?
CVE-2026-18378 affects the Project-koku koku-metrics-operator.
How do I fix CVE-2026-18378?
To fix CVE-2026-18378, ensure that the api_url parameter is validated and implement host allow-listing for secure URLs.
What is the impact of CVE-2026-18378?
The impact of CVE-2026-18378 includes potential unauthorized access to cluster-level pull secrets, leading to further exploitation.