Credential Exfiltration via koku-metrics-operator SSRF

The koku-metrics-operator is vulnerable to a Server-Side Request Forgery (SSRF) flaw, identified as CVE-2026-18378. The vulnerability exists within the CostManagementMetricsConfig custom resource, which lacks sufficient input validation when defining an upload URL for metrics. An attacker with privileges to edit this custom resource can define an attacker-controlled endpoint as the destination for metric uploads. When the authentication.type is set to the default 'token' configuration, the operator automatically attaches the cluster-global Red Hat Cloud pull-secret bearer token to outgoing HTTP requests. This results in the leakage of sensitive cluster credentials to an external server controlled by the attacker. This issue impacts the Red Hat Cost Management Metrics Operator and is classified as a high-severity credential access vector.

Attack Chain

1. Attacker gains administrative access to the Kubernetes cluster or specific namespace permissions allowing modification of custom resources.
2. Attacker retrieves or identifies the existing koku-metrics-operator deployment in the cluster.
3. Attacker modifies the CostManagementMetricsConfig custom resource.
4. Attacker inserts a malicious, attacker-controlled URL into the configuration field intended for metric uploads.
5. Operator service attempts to transmit metrics to the attacker-supplied URL using the configured token authentication.
6. The outgoing HTTP request includes the cluster-global Red Hat pull-secret bearer token in the Authorization header.
7. Attacker receives and captures the bearer token from the incoming request logs on their controlled server.
8. Attacker utilizes the stolen bearer token to potentially access Red Hat Cloud services or perform unauthorized actions within the authenticated scope of the token.

Impact

Successful exploitation allows an authenticated attacker to steal the cluster-global pull-secret. This credential provides the ability to authenticate as the cluster to Red Hat services, potentially leading to unauthorized data access, service manipulation, or further credential compromise across the associated cloud environment.

Recommendation

1. Audit existing CostManagementMetricsConfig resources for unauthorized or unexpected destination URLs.
2. Monitor Kubernetes audit logs for modifications to the koku-metrics-operator custom resource definitions.
3. Apply available patches from Red Hat for the affected operator once released.
4. Restrict RBAC permissions for modifying CostManagementMetricsConfig to the minimum necessary users to prevent unauthorized configuration changes.