REDHAT-BUG-2509249: High severity koku-metrics-operator vulnerability
Summary
The koku-metrics-operator CostManagementMetricsConfig CRD exposes spec.apiurl as a free-form string with no host allow-list or schema validation. When spec.authentication.type == token (the default), the operator reads the cluster-global openshift-config/pull-secret, extracts the cloud.openshift.com bearer token, and attaches it as Authorization: Bearer <token> on an outbound POST to the user-supplied URL. No comparison against the default https://console.redhat.com gates credential attachment.
Impact
A principal with create/update permission on costmanagementmetricsconfigs in the operator namespace can cause the operator to send the cluster's Red Hat Cloud / registry pull-secret bearer token to an arbitrary external or in-cluster endpoint. This credential authenticates the entire cluster to console.redhat.com and registry.redhat.io.
Affected Code
- api/v1beta1/metricsconfigtypes.go:249 — APIURL field definition (no validation) - internal/controller/costmanagementmetricsconfigcontroller.go:128,235,258,590 — credential extraction and URL construction - internal/crhchttp/httpclouddotredhat.go:94 — bearer token attachment to HTTP request
Remediation
Reject token authentication when apiurl != DefaultAPIURL. Add a CEL validation rule on the CRD:
yaml x-kubernetes-validations: - rule: "self.authentication.type != 'token' || self.apiurl == 'https://console.redhat.com'" message: "token authentication is only permitted against https://console.redhat.com"
Or implement the check in the reconciler before calling Upload().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Add a CEL validation to the CostManagementMetricsConfig CRD so that token authentication is only permitted when spec.api_url equals the default console.redhat.com URL (i.e., include the rule: "self.authentication.type != 'token' || self.api_url == '<a href=\"https://console.redhat.com\">https://console.redhat.com</a>'").
koku-metrics-operator CostManagementMetricsConfig CRD x-kubernetes-validations rule = self.authentication.type != 'token' || self.api_url == '<a href="https://console.redhat.com">https://console.redhat.com</a>' - Configuration
Implement a reconciler-side check before calling Upload(): when spec.authentication.type is 'token', only attach the extracted Authorization: Bearer <token> if spec.api_url matches the default API URL; otherwise reject the request/CR reconciliation.
koku-metrics-operator reconciler (CostManagementMetricsConfig controller) token credential attachment gating = Reject token authentication when spec.api_url != DefaultAPIURL
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2509249?
The severity of REDHAT-BUG-2509249 is classified as high with a score of 7.
How do I fix REDHAT-BUG-2509249?
To mitigate REDHAT-BUG-2509249, ensure validation for the 'spec.api_url' and implement a proper allow-list for hosts.
What risks are associated with REDHAT-BUG-2509249?
REDHAT-BUG-2509249 poses risks of unauthorized access and potential exploitation due to exposed unvalidated input.
What components are affected by REDHAT-BUG-2509249?
The koku-metrics-operator and its CostManagementMetricsConfig CRD are affected by REDHAT-BUG-2509249.
When was REDHAT-BUG-2509249 published?
REDHAT-BUG-2509249 was published on July 30, 2026.