CVE-2026-18382

MediumCVSS 6.8/10Last modified Oct 23, 2026

Description

A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary OAuth token endpoint. When authentication.type is set to service-account, the operator sends the tenant's Red Hat SSO client_id and client_secret to this user-controlled URL, allowing the attacker to obtain the credentials.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-918

Affected software

Vendor	Product	Versions
Red Hat	Cost Management 4	—

References

https://access.redhat.com/errata/RHSA-2026:81201
https://access.redhat.com/security/cve/CVE-2026-18382Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2509253Issue Tracking, Mitigation, Vendor Advisory

Timeline

Published: Jul 30, 2026
Last modified: Oct 23, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-183855.4The The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for Wor CVE-2026-183864.9The WP BackItUp Community Edition plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.0 via CVE-2026-183876.5The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection via the 'tag_query' CVE-2026-18397.8A vulnerability in the HuggingFace Transformers library, specifically in the `Trainer` class, allows for arbitrary code execution. The `_loa CVE-2026-183907.8Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Ministry of Justice General Dire CVE-2026-183919.8The WooCommerce Subscriptions WordPress plugin before 9.1.0 does not validate user input before unserializing it on stores with High-Perform CVE-2026-183935.4A flaw was found in FFmpeg. The tdsc_load_cursor() function writes beyond the bounds of a heap-allocated buffer when processing crafted TDSC CVE-2026-183947.4Incorrect authorization in the http_request tool in Strands Agents Tools before 0.8.2 might allow remote attackers to obtain credentials con CVE-2026-183955.4The Child Pages Card WordPress plugin before 1.09 does not sanitise and escape some of its shortcode attributes before outputting them back CVE-2026-183979.4This vulnerability enables unauthenticated remote code execution (RCE) on a victim's machine by exploiting a combination of cryptographic we CVE-2026-18407.5The Aclara Metrum Cellular Web Interface is vulnerable to unauthorized access due to the absence of authentication controls on critical syst CVE-2026-184006.4The Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripti