Koku Metrics Operator
by Project Koku
CVEs (3)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-18378 | imp | 0.49 | 7.6 | — | Jul 30, 2026 | project-koku/koku-metrics-operator: koku-metrics-operator: cluster pull-secret token exfiltration via user-controlled api_url (SSRF / confused deputy) | ||
| CVE-2026-18381 | imp | 0.49 | 7.6 | — | Jul 30, 2026 | project-koku/koku-metrics-operator: koku-metrics-operator: operator service-account token exfiltration via user-controlled Prometheus service_address | ||
| CVE-2026-18382 | mod | 0.44 | 6.8 | — | Jul 30, 2026 | project-koku/koku-metrics-operator: koku-metrics-operator: service-account client credentials sent to user-controlled token_url |
- risk 0.49cvss 7.6epss —
project-koku/koku-metrics-operator: koku-metrics-operator: cluster pull-secret token exfiltration via user-controlled api_url (SSRF / confused deputy)
- risk 0.49cvss 7.6epss —
project-koku/koku-metrics-operator: koku-metrics-operator: operator service-account token exfiltration via user-controlled Prometheus service_address
- risk 0.44cvss 6.8epss —
project-koku/koku-metrics-operator: koku-metrics-operator: service-account client credentials sent to user-controlled token_url