CVE-2026-18382: Project-koku/koku-metrics-operator: koku-metrics-operator: service-account client credentials sent to user-controlled token_url
Summary
The koku-metrics-operator CostManagementMetricsConfig CRD exposes spec.authentication.tokenurl as a writable field with no host validation. When spec.authentication.type == service-account, the operator POSTs clientid and clientsecret (read from a user-referenced Secret) as form data to this user-supplied URL. The default is the Red Hat SSO endpoint, but a CR editor can override it to any URL.
Impact
A principal with create/update permission on costmanagementmetricsconfigs can redirect the tenant's Red Hat SSO clientid/clientsecret pair to an attacker endpoint. These credentials grant api.console scope on console.redhat.com for the customer organization.
Affected Code
- api/v1beta1/metricsconfigtypes.go:117 — tokenurl field definition (no validation) - internal/controller/costmanagementmetricsconfigcontroller.go:450 — GetAccessToken(ctx, cr.Spec.Authentication.TokenURL) call - internal/crhchttp/config.go:75-93 — POST to user-supplied tokenURL
Remediation
Hard-code the Red Hat SSO token endpoint or enforce a suffix allow-list (.redhat.com) in GetAccessToken. Reject non-HTTPS schemes:
go if !strings.HasSuffix(tokenURL, ".redhat.com") { return "", fmt.Errorf("tokenurl must be a .redhat.com endpoint") }
Other sources
A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary OAuth token endpoint. When authentication.type is set to service-account, the operator sends the tenant's Red Hat SSO clientid and clientsecret to this user-controlled URL, allowing the attacker to obtain the credentials.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In CostManagementMetricsConfig handling (GetAccessToken / POST to token_url), enforce that spec.authentication.token_url is a *.redhat.com endpoint (e.g., require HasSuffix(tokenURL, ".redhat.com")) and reject non-HTTPS schemes, so user-controlled token_url cannot redirect the tenant Red Hat SSO client_id/client_secret to an attacker endpoint.
koku-metrics-operator (CostManagementMetricsConfig CRD) spec.authentication.token_url = Enforce allow-list for token_url suffix (*.redhat.com) and reject non-HTTPS schemes
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18382?
The severity of CVE-2026-18382 is medium with a score of 6.8.
How do I fix CVE-2026-18382?
To fix CVE-2026-18382, ensure that the token_url in the CostManagementMetricsConfig CRD is properly validated and restrict access to trusted hosts only.
What type of vulnerability is CVE-2026-18382?
CVE-2026-18382 is classified as a Server-Side Request Forgery (SSRF) vulnerability.
What can be exposed due to CVE-2026-18382?
CVE-2026-18382 can expose sensitive client credentials, such as client_id and client_secret, to unauthorized users.
What software is affected by CVE-2026-18382?
CVE-2026-18382 affects the Project-koku/koku-metrics-operator software.