Is CVE-2026-18381 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-18381 being exploited in the wild.

How severe is CVE-2026-18381?

High severity, with a CVSS score of 7.6, published 30 July 2026.

Which products and versions are affected?

Red Hat Cost Management Metrics Operator 4.

Is there a fix for CVE-2026-18381?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-18381 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2026-18381?

Check whether you run Red Hat Cost Management Metrics Operator at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-18381: Red Hat OpenShift koku-metrics-operator SSRF and Token Exfiltration

CVE-2026-18381 · Severity: high · CVSS 7.6 · Published 2026-07-30

A security vulnerability has been identified in the Red Hat OpenShift Cost Management Metrics Operator, a tool used to track and manage resource costs within cloud environments. An attacker with administrative permissions can redirect the tool's data requests to a server they control, causing the tool to inadvertently hand over its own security credentials. These stolen credentials could allow the attacker to access sensitive information, such as passwords and encryption keys, across the entire OpenShift cluster.

Technologies: Red Hat Cost Management Metrics Operator. Vendors: Red Hat.

Quick answers

Is CVE-2026-18381 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-18381 being exploited in the wild.
How severe is CVE-2026-18381?: High severity, with a CVSS score of 7.6, published 30 July 2026.
Which products and versions are affected?: Red Hat Cost Management Metrics Operator 4.
Is there a fix for CVE-2026-18381?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-18381 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2026-18381?: Check whether you run Red Hat Cost Management Metrics Operator at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in the koku-metrics-operator (Cost Management Metrics Operator) for Red Hat OpenShift. The `CostManagementMetricsConfig` Custom Resource Definition (CRD) fails to validate the `spec.prometheus_config.service_address` field, allowing a user with 'create' or 'update' permissions on the CRD to specify an arbitrary URL. The operator reads its own Kubernetes service-account token and attaches it as a Bearer token to queries sent to this address. Because the operator's service account is typically assigned a ClusterRole with 'get' permissions on all Secrets cluster-wide, an attacker can capture this token and use it to access sensitive data across the entire cluster. Remediation involves implementing CEL validation in the CRD to restrict URLs to trusted in-cluster endpoints.

Affected products

Red Hat Cost Management Metrics Operator 4

Timeline

2026-07-30: disclosed: Vulnerability reported and published in NVD and Red Hat advisory.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.