AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Red HatCVE-2026-18382

Red Hat Cost Management Metrics Operator: server-side request forgery

Red Hat

CVE-2026-18382 · Published Jul 30, 2026 · updated Aug 12, 2026

Medium6.8
No fix yet
Red Hat advisory

A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary OAuth token endpoint. When authentication.type is set to service-account, the operator sends the tenant's Red Hat SSO client_id and client_secret to this user-controlled URL, allowing the attacker to obtain the credentials.

Affected versions

PackageAffectedFixed in
Cost Management Metrics Operator
Product
all versionsNo fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-918

More Red Hat advisories

All Red Hat
Medium 6.2Jul 30ansible-collection-redhat-leapp: information disclosureCVE-2026-68562no fix yetMedium 5.5Jul 30ansible-collection-redhat-leapp.: insecure permissionsCVE-2026-68563no fix yetMedium 5.3Jul 30Red Hat Samba: out-of-bounds readCVE-2026-58216no fix yetHigh 8.8Jul 30Red Hat Enterprise Linux 10: improper authorizationCVE-2026-58222no fix yetMedium 5.3Jul 30Red Hat Samba: denial of serviceCVE-2026-58218no fix yetHigh 7.6Jul 30Red Hat Cost Management Metrics Operator: server-side request forgeryCVE-2026-18378no fix yet