koku-metrics-operator: attacker-set upload URL leaks the operator's service-account token

Impact

The CostManagementMetricsConfig custom resource accepts an arbitrary upload URL, and the operator attaches its own Kubernetes service-account bearer token to requests sent there. Anyone able to edit that CR can point it at a collector they control and receive the operator's token, which then grants whatever that service account holds inside the cluster - a credential-theft primitive against the OpenShift control plane rather than a bug in cost reporting. CVSS scope is marked changed for this reason. It needs high privileges to start with (edit rights on the CR), so this is privilege escalation from a namespace-scoped role toward cluster-level access, which matters on a multi-tenant OpenShift GPU cluster where tenants hold namespace admin.

Who can reach it

An authenticated cluster user with permission to edit the CostManagementMetricsConfig custom resource, reaching the Kubernetes API over the network. No user interaction.

What to do

Apply Red Hat erratum RHSA-2026:81201 for the cost management metrics operator. Updating an operator means rolling its deployment, not touching nodes - no drain needed. Restrict RBAC on CostManagementMetricsConfig to cluster administrators, and rotate the operator's service-account token if the CR has been edited by anyone who should not have it.

References

Related entries

• Sidero Omni: Reader role can read the full CA secrets bundle of an imported Talos clusterCVE-2026-45726 · Sidero Omni (ImportedClusterSecrets resource access rules)High
• rsync SSL modes: server TLS certificates are not validated, so an on-path attacker can read the transferCVE-2026-70454 · rsync (openssl mode) and rsync-ssl (stunnel mode) TLS server certificate validationHigh
• Red Hat Ansible Automation Platform automation-controller (custom Credential Type env injector): The custom CredentialCVE-2026-84706 · Red Hat Ansible Automation Platform automation-controller (custom Credential Type env injector)High
• OpenZFS (sharenfs export generation): When an NFS share is exported to IPv6 addresses via sharenfs, OpenZFS silentlyCVE-2013-20001 · OpenZFS (sharenfs export generation)High
• ISC BIND: a single TKEY query trips a REQUIRE assertion and exits namedCVE-2015-5477 · ISC BIND named (TKEY query handling)High
• Ceph CephX authentication protocol: An attacker who sniffs the storage network can replay a CephX authenticationCVE-2018-1128 · Ceph CephX authentication protocolHigh