CVE-2026-18382 Red Hat CVE debrief

Who should care

Defenders responsible for environments using the Cost Management Metrics Operator should assess exposure and prioritize verification and potential remediation. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify if the Cost Management Metrics Operator is used in their environment and if it is configured with authentication.type set to service-account. They should also review and limit

Why it matters

Defenders should care about CVE-2026-18382 because it allows users to specify an arbitrary OAuth token endpoint in the CostManagementMetricsConfig custom resource, potentially leading to credential exposure. Environments using the Cost Management Metrics Operator with authentication.type set to service-account are at risk. Defenders should verify exposure, consider compensating controls, and limit access to the custom resource.

• Potential credential exposure for Red Hat SSO client_id and client_secret
• Need for verification of exposure in environments using Cost Management Metrics Operator
• Possible need for compensating controls until official remediation is applied
• Importance of limiting access to the CostManagementMetricsConfig custom resource

Technical summary

The koku-metrics-operator's CostManagementMetricsConfig custom resource allows users to specify an arbitrary OAuth token endpoint. When authentication.type is set to service-account, the operator sends the tenant's Red Hat SSO client_id and client_secret to this user-controlled URL, potentially allowing attackers to obtain these credentials. This issue is particularly concerning for environments using the Cost Management Metrics Operator with authentication.type set to service-account. Defenders should prioritize verifying exposure in their environments and assess the need for compensating controls.

Defensive priority

Defenders should prioritize verifying exposure in their environments, especially those using the Cost Management Metrics Operator, and assess the need for compensating controls.

Recommended defensive actions

• Verify if the Cost Management Metrics Operator is used in your environment and assess exposure.
• Check if authentication.type is set to service-account and if there are any compensating controls in place.
• Review and limit access to the CostManagementMetricsConfig custom resource.
• Consider monitoring for suspicious activity related to OAuth token endpoints.
• Review vendor guidance and apply patches or updates as recommended.
• Perform an inventory of assets that may be affected by this vulnerability.
• Track exceptions and retest remediated assets to ensure the issue is resolved.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in koku-metrics-operator. Red Hat has released advisories (RHSA-2026:81201) and a bug report (2509253) related to this issue. The vulnerability allows users to specify an arbitrary OAuth token endpoint in the CostManagementMetricsConfig custom resource, potentially leading to credential exposure. Defenders should verify exposure, consider compensating controls, and limit access to the custom resource. The issue is particularly concerning for environments using the Cost

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.