Executive brief
A security vulnerability exists in the Red Hat Cost Management Metrics Operator, a tool used to manage and report cloud usage costs. An attacker with permissions to modify the operator's configuration can redirect sensitive login credentials to a server they control. If exploited, this allows the attacker to steal service account credentials and gain unauthorized access to the organization's Red Hat console data.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the koku-metrics-operator's CostManagementMetricsConfig custom resource (CR). The 'token_url' field in the CR lacks proper host validation, allowing a user with 'create' or 'update' permissions on the resource to specify an arbitrary URL. When the authentication type is set to 'service-account', the operator performs a POST request containing the tenant's Red Hat SSO client_id and client_secret to the user-supplied URL. This allows an attacker to intercept credentials that grant 'api.console' scope on console.redhat.com. Remediation involves enforcing a strict allow-list for the token endpoint (e.g., *.redhat.com) and requiring HTTPS.
Affected products
- Red Hat Cost Management Metrics Operator (koku-metrics-operator) unspecified
Timeline
- 2026-07-30: disclosed: Vulnerability reported and published to NVD