CVE-2026-18381

Katalog CVE

CVSS 7.6 · High EPSS 0,38%

Kerentanan Server-Side Request Forgery (SSRF) pada redhat cost management metrics operator. Skor CVSS 3.1 7.6 (High) menurut NVD.

Deskripsi (NVD)

A flaw was found in the koku-metrics-operator for Red Hat OpenShift. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary upload URL. The operator attaches its own Kubernetes service-account bearer token to queries sent to this user-controlled URL, allowing the attacker to obtain the token.

Rincian

Terbit di NVD

30 Juli 2026

Terakhir diubah

12 Oktober 2026

Status NVD

Modified

CVSS 3.1

7.6 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

0,38% peluang dieksploitasi; lebih tinggi dari 29,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/security/cve/CVE-2026-18381 advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2509251 issue tracking · mitigasi · advisory vendor
• https://access.redhat.com/errata/RHSA-2026:81201