VULNERABILITY INTELLIGENCE

CVE-2026-18382

CVSS score6.8 MEDIUM
EPSS probability0.52%
CISA KEVNot currently listed
Published2026-07-30
Last modified2026-10-23
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Description

A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary OAuth token endpoint. When authentication.type is set to service-account, the operator sends the tenant's Red Hat SSO client_id and client_secret to this user-controlled URL, allowing the attacker to obtain the credentials.

Weakness classification

  • secalert@redhat.com: CWE-918

Primary references