Project Koku: Three Koku-Metrics-Operator Flaws Enable Token Exfiltration
Key findings • Three vulnerabilities in Project Koku's koku-metrics-operator disclosed on July 30, 2026. • Two 'important' severity flaws (CVSSv3 7.6) involve cluster pull-secret and operator…
Key findings
- Three vulnerabilities in Project Koku's koku-metrics-operator disclosed on July 30, 2026.
- Two 'important' severity flaws (CVSSv3 7.6) involve cluster pull-secret and operator service-account token exfiltration.
- A 'moderate' severity flaw (CVSSv3 6.8) allows service-account client credentials to be sent to user-controlled URLs.
- Vulnerabilities stem from SSRF and improper handling of user-controlled API URLs, Prometheus addresses, and token URLs.
On July 30, 2026, three vulnerabilities were disclosed in Project Koku's koku-metrics-operator, with two rated as 'important' and one as 'moderate'. These flaws primarily revolve around the exfiltration of sensitive tokens and credentials through user-controlled URLs and addresses, posing a significant risk to cluster security.
The vulnerabilities identified are CVE-2026-18378, CVE-2026-18381, and CVE-2026-18382.
CVE-2026-18378, a Server-Side Request Forgery (SSRF) and confused deputy vulnerability, allows for the exfiltration of a cluster's pull-secret token by leveraging a user-controlled api_url. This could grant unauthorized access to sensitive cluster information.
CVE-2026-18381 focuses on the potential exfiltration of the operator's service-account token. By manipulating the service_address parameter for Prometheus, an attacker could potentially gain access to the operator's credentials, leading to further compromise.
CVE-2026-18382 addresses a vulnerability where service-account client credentials are sent to a user-controlled token_url. This could enable an attacker to intercept or redirect these credentials, compromising the service account's integrity.
All three vulnerabilities were disclosed on the same day, indicating a potential cluster of related security issues within the koku-metrics-operator. The impact of these vulnerabilities could range from unauthorized access to sensitive data to the complete compromise of cluster resources, depending on the specific exploit and the attacker's objectives.
As of the disclosure, specific patch details or version information for the fixes were not immediately available. Users of Project Koku's koku-metrics-operator are advised to monitor official Project Koku security advisories for updates and remediation guidance. Prompt patching and verification of configurations related to API URLs, Prometheus addresses, and token URLs will be critical for mitigating these risks.
This batch of vulnerabilities underscores the importance of carefully validating user-supplied inputs, especially those related to network endpoints and authentication mechanisms, within critical infrastructure components like the koku-metrics-operator. Users should remain vigilant for further security communications from the Project Koku team.