CVE-2026-18381

HighCVSS 7.6/10Last modified Oct 23, 2026

Description

A flaw was found in the koku-metrics-operator for Red Hat OpenShift. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary upload URL. The operator attaches its own Kubernetes service-account bearer token to queries sent to this user-controlled URL, allowing the attacker to obtain the token.

Metrics

CVSS 3.1 7.6/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N

Weakness enumeration

CWE-918

Affected software

Vendor	Product	Versions
Red Hat	Cost Management 4	—

References

https://access.redhat.com/errata/RHSA-2026:81201
https://access.redhat.com/security/cve/CVE-2026-18381Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2509251Issue Tracking, Mitigation, Vendor Advisory

Timeline

Published: Jul 30, 2026
Last modified: Oct 23, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-183826.8A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to s CVE-2026-183855.4The The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for Wor CVE-2026-183864.9The WP BackItUp Community Edition plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.0 via CVE-2026-183876.5The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection via the 'tag_query' CVE-2026-18397.8A vulnerability in the HuggingFace Transformers library, specifically in the `Trainer` class, allows for arbitrary code execution. The `_loa CVE-2026-183907.8Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Ministry of Justice General Dire CVE-2026-183919.8The WooCommerce Subscriptions WordPress plugin before 9.1.0 does not validate user input before unserializing it on stores with High-Perform CVE-2026-183935.4A flaw was found in FFmpeg. The tdsc_load_cursor() function writes beyond the bounds of a heap-allocated buffer when processing crafted TDSC CVE-2026-183947.4Incorrect authorization in the http_request tool in Strands Agents Tools before 0.8.2 might allow remote attackers to obtain credentials con CVE-2026-183955.4The Child Pages Card WordPress plugin before 1.09 does not sanitise and escape some of its shortcode attributes before outputting them back CVE-2026-183979.4This vulnerability enables unauthenticated remote code execution (RCE) on a victim's machine by exploiting a combination of cryptographic we CVE-2026-18407.5The Aclara Metrum Cellular Web Interface is vulnerable to unauthorized access due to the absence of authentication controls on critical syst