Executive brief
The Red Hat Cost Management Metrics Operator, which helps track resource usage and costs in OpenShift clusters, contains a security flaw. An authorized user can redirect the operator to send sensitive cluster credentials to a server they control. This could allow an attacker to steal the cluster's Red Hat Cloud pull-secret token, potentially compromising the organization's access to Red Hat services and registries.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the koku-metrics-operator (Cost Management Metrics Operator) due to a lack of validation in the 'spec.api_url' field of the CostManagementMetricsConfig custom resource. When the authentication type is set to 'token' (the default), the operator extracts the cluster-global 'openshift-config/pull-secret' and attaches it as a bearer token to outbound POST requests. Because there is no allow-list for the API URL, an attacker with permissions to create or update these custom resources can specify an arbitrary endpoint to receive the sensitive token. This allows for the exfiltration of credentials that authenticate the cluster to console.redhat.com and registry.redhat.io. Remediation involves implementing validation rules to ensure token authentication is only used with the default Red Hat API URL.
Affected products
- Red Hat Cost Management Metrics Operator 4
Timeline
- 2026-07-30: disclosed: Initial report via Red Hat Bugzilla and NVD publication.
- 2026-07-30: advisory