Executive brief
A security vulnerability has been identified in the Red Hat OpenShift Cost Management Metrics Operator, a tool used to track and manage resource costs within cloud environments. An attacker with administrative permissions can redirect the tool's data requests to a server they control, causing the tool to inadvertently hand over its own security credentials. These stolen credentials could allow the attacker to access sensitive information, such as passwords and encryption keys, across the entire OpenShift cluster.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the koku-metrics-operator (Cost Management Metrics Operator) for Red Hat OpenShift. The `CostManagementMetricsConfig` Custom Resource Definition (CRD) fails to validate the `spec.prometheus_config.service_address` field, allowing a user with 'create' or 'update' permissions on the CRD to specify an arbitrary URL. The operator reads its own Kubernetes service-account token and attaches it as a Bearer token to queries sent to this address. Because the operator's service account is typically assigned a ClusterRole with 'get' permissions on all Secrets cluster-wide, an attacker can capture this token and use it to access sensitive data across the entire cluster. Remediation involves implementing CEL validation in the CRD to restrict URLs to trusted in-cluster endpoints.
Affected products
- Red Hat Cost Management Metrics Operator 4
Timeline
- 2026-07-30: disclosed: Vulnerability reported and published in NVD and Red Hat advisory.