Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions |
|---|---|---|---|
| Red Hat | Cost Management Metrics Operator | affected | — |
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Thu, 30 Jul 2026 13:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Thu, 30 Jul 2026 12:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary OAuth token endpoint. When authentication.type is set to service-account, the operator sends the tenant's Red Hat SSO client_id and client_secret to this user-controlled URL, allowing the attacker to obtain the credentials. | |
| Title | Project-koku/koku-metrics-operator: koku-metrics-operator: service-account client credentials sent to user-controlled token_url | |
| First Time appeared |
Redhat
Redhat cost Management |
|
| Weaknesses | CWE-918 | |
| CPEs | cpe:/a:redhat:cost_management:4 | |
| Vendors & Products |
Redhat
Redhat cost Management |
|
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: redhat
Published:
Updated: 2026-07-30T13:05:36.789Z
Reserved: 2026-07-30T11:46:08.800Z
Link: CVE-2026-18382
Vulnrichment
Updated: 2026-07-30T13:05:32.303Z
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.
-
CWE-918
Server-Side Request Forgery (SSRF)