Is CVE-2026-18378 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-18378 being exploited in the wild.

How severe is CVE-2026-18378?

High severity, with a CVSS score of 7.6, published 30 July 2026.

Which products and versions are affected?

Red Hat Cost Management Metrics Operator 4.

Is there a fix for CVE-2026-18378?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-18378 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-18378?

Check whether you run Red Hat Cost Management Metrics Operator at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-18378: Red Hat koku-metrics-operator SSRF in CostManagementMetricsConfig

CVE-2026-18378 · Severity: high · CVSS 7.6 · Published 2026-07-30

The Red Hat Cost Management Metrics Operator, which helps track resource usage and costs in OpenShift clusters, contains a security flaw. An authorized user can redirect the operator to send sensitive cluster credentials to a server they control. This could allow an attacker to steal the cluster's Red Hat Cloud pull-secret token, potentially compromising the organization's access to Red Hat services and registries.

Technologies: Red Hat Cost Management Metrics Operator. Vendors: Red Hat.

Quick answers

Is CVE-2026-18378 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-18378 being exploited in the wild.
How severe is CVE-2026-18378?: High severity, with a CVSS score of 7.6, published 30 July 2026.
Which products and versions are affected?: Red Hat Cost Management Metrics Operator 4.
Is there a fix for CVE-2026-18378?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-18378 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-18378?: Check whether you run Red Hat Cost Management Metrics Operator at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in the koku-metrics-operator (Cost Management Metrics Operator) due to a lack of validation in the 'spec.api_url' field of the CostManagementMetricsConfig custom resource. When the authentication type is set to 'token' (the default), the operator extracts the cluster-global 'openshift-config/pull-secret' and attaches it as a bearer token to outbound POST requests. Because there is no allow-list for the API URL, an attacker with permissions to create or update these custom resources can specify an arbitrary endpoint to receive the sensitive token. This allows for the exfiltration of credentials that authenticate the cluster to console.redhat.com and registry.redhat.io. Remediation involves implementing validation rules to ensure token authentication is only used with the default Red Hat API URL.

Affected products

Red Hat Cost Management Metrics Operator 4

Timeline

2026-07-30: disclosed: Initial report via Red Hat Bugzilla and NVD publication.
2026-07-30: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.