HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-18381 — A flaw was found in the koku-metrics-operator for Red Hat OpenShift. The operato...

·Source: NIST NVD

Updated:

Executive Summary

A flaw was found in the koku-metrics-operator for Red Hat OpenShift. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary upload URL. The operator attaches its own Kubernetes service-account bearer token to queries sent to this user-controlled URL, allowing the attacker to obtain the token.

Analysis

A flaw was found in the koku-metrics-operator for Red Hat OpenShift. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary upload URL. The operator attaches its own Kubernetes service-account bearer token to queries sent to this user-controlled URL, allowing the attacker to obtain the token. CVSS Score: 7.6. Published: 2026-07-30T12:17:27.693.

Indicators of Compromise (1)

CVE (1)
CVE-2026-18381
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jul 30, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

Ghanaian national sentenced to 7 years in prison for stealing $10M from romance scam victims

Derrick Van Yeboah impersonated fake romantic partners and directly interacted with victims for more than nine years. The post Ghanaian national sentenced to 7 years in prison for stealing $10M from romance scam victims appeared first on CyberScoop .

CyberScoop
HIGHVulnerability

NVD HIGH: CVE-2026-67351 — Serendipity before 2.6.1 contains an authentication context confusion vulnerabil...

Serendipity before 2.6.1 contains an authentication context confusion vulnerability where password validation and session loading operate independently without ensuring both use the same user record. An authenticated Editor can create a username collision with an Administrator account and obtain administrative privileges by logging in with their own password while the session loads the Administrat

CVE-2026-67351
NIST NVD
HIGHVulnerability

NVD HIGH: CVE-2026-5219 — Cross-Site request forgery (CSRF) vulnerability in Softtr Information Technology...

Cross-Site request forgery (CSRF) vulnerability in Softtr Information Technology Trade Ltd. Co. E-Commerce Pack allows Cross Site Request Forgery. This issue affects E-Commerce Pack: through 30072026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-5219
NIST NVD