CVE-2026-18382

A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary OAuth token endpoint. When authentication.type is set to service-account, the operator sends the tenant's Red Hat SSO clientid and...

CVE-2026-18378

A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows user able to edit the CR to specify an arbitrary upload URL. When authentication.type is set to token the default, the cluster-global Red Hat Cloud pull-secret bearer token is attached to...

CVE-2026-18381 Project-koku/koku-metrics-operator: koku-metrics-operator: operator service-account token exfiltration via user-controlled prometheus service_address

A flaw was found in the koku-metrics-operator for Red Hat OpenShift. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary upload URL. The operator attaches its own Kubernetes service-account bearer token to queries sent to this...

EUVD-2026-51093

A flaw was found in the koku-metrics-operator for Red Hat OpenShift. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary upload URL. The operator attaches its own Kubernetes service-account bearer token to queries sent to this...

CVE-2026-18381

The CVE-2026-18381 affects the koku-metrics-operator used with Red Hat OpenShift. A flaw in the CostManagementMetricsConfig custom resource lets an authorized user edit the CR to specify an arbitrary upload URL. The operator then attaches its Kubernetes service-account bearer token to queries sen...

CVE-2026-18381 Project-koku/koku-metrics-operator: koku-metrics-operator: operator service-account token exfiltration via user-controlled prometheus service_address

A flaw was found in the koku-metrics-operator for Red Hat OpenShift. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary upload URL. The operator attaches its own Kubernetes service-account bearer token to queries sent to this...

CVE-2026-18381

A flaw was found in the koku-metrics-operator for Red Hat OpenShift. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary upload URL. The operator attaches its own Kubernetes service-account bearer token to queries sent to this...

CVE-2026-18381

A flaw was found in the koku-metrics-operator for Red Hat OpenShift. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary upload URL. The operator attaches its own Kubernetes service-account bearer token to queries sent to this...

CLEANSTART-2026-ZQ47367 Security fixes in metrics-server-fips 0.5.2-r3

Package metrics-server-fips version 0.5.2-r3 fixes 4 vulnerabilities: ghsa-2xhq-gv6c-p224, ghsa-m425-mq94-257g, ghsa-wf43-55jj-vwq8, ghsa-wr2v-9rpq-c35q...

CLEANSTART-2026-AJ94183 Security fixes in kube-state-metrics-fips 2.17.0-r1

Package kube-state-metrics-fips version 2.17.0-r1 fixes 2 vulnerabilities: ghsa-f6x5-jh6r-wrfv, ghsa-j5w8-q4qc-rx2x...

CLEANSTART-2026-IV23706 Security fixes in kube-state-metrics 2.19.1-r0

Package kube-state-metrics version 2.19.1-r0 fixes 2 vulnerabilities: CVE-2026-42505, CVE-2026-39822...

CLEANSTART-2026-QD19370 Security fixes in kube-state-metrics-fips 2.15.0-r0

Package kube-state-metrics-fips version 2.15.0-r0 fixes 6 vulnerabilities: CVE-2025-61727, CVE-2025-61729, ghsa-6v2p-p543-phr9, ghsa-hcg3-q754-cr77, ghsa-qxp5-gwg8-xv66...

CLEANSTART-2026-BL61826 Security fixes in metrics-server-fips 0.7.2-r3

Package metrics-server-fips version 0.7.2-r3 fixes 2 vulnerabilities: CVE-2025-61727, CVE-2025-61729...

CLEANSTART-2026-OY66668 Security fixes in metrics-server-fips 0.8.0-r3

Package metrics-server-fips version 0.8.0-r3 fixes 3 vulnerabilities: CVE-2025-47907, CVE-2025-0913, CVE-2025-4673...

CLEANSTART-2026-IF30502 Security fixes in kube-state-metrics 2.10.1-r1

Package kube-state-metrics version 2.10.1-r1 fixes 24 vulnerabilities: CVE-2026-27143, CVE-2026-27140, CVE-2026-27144, CVE-2026-32280, CVE-2026-32281...

CLEANSTART-2026-UX42844 Security fixes in metrics-server 0.8.0-r0

Package metrics-server version 0.8.0-r0 fixes 5 vulnerabilities: CVE-2025-61727, CVE-2025-61729, CVE-2025-47907, CVE-2025-0913, CVE-2025-4673...

CLEANSTART-2026-XF99533 Security fixes in kube-state-metrics 2.17.0-r3

Package kube-state-metrics version 2.17.0-r3 fixes 1 vulnerabilities: CVE-2026-42504...

CLEANSTART-2026-YN39605 Security fixes in kube-state-metrics-fips 2.17.0-r0

Package kube-state-metrics-fips version 2.17.0-r0 fixes 1 vulnerabilities: ghsa-2464-837c-4c3m...

CLEANSTART-2026-OQ99090 Security fixes in kube-metrics-adapter 0.2.9-r0

Package kube-metrics-adapter version 0.2.9-r0 fixes 3 vulnerabilities: CVE-2026-40890, CVE-2023-42821, CVE-2026-40898...

CLEANSTART-2026-ZL91163 Security fixes in kubernetes-dashboard-metrics-scraper 1.2.2-r1

Package kubernetes-dashboard-metrics-scraper version 1.2.2-r1 fixes 5 vulnerabilities: CVE-2026-25679, CVE-2026-27142, CVE-2026-27137, CVE-2026-27138, CVE-2026-27139...