CVE-2026-18382

A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary OAuth token endpoint. When authentication.type is set to service-account, the operator sends the tenant's Red Hat SSO clientid and...

CVE-2026-18378

A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows user able to edit the CR to specify an arbitrary upload URL. When authentication.type is set to token the default, the cluster-global Red Hat Cloud pull-secret bearer token is attached to...

CVE-2026-18381 Project-koku/koku-metrics-operator: koku-metrics-operator: operator service-account token exfiltration via user-controlled prometheus service_address

A flaw was found in the koku-metrics-operator for Red Hat OpenShift. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary upload URL. The operator attaches its own Kubernetes service-account bearer token to queries sent to this...

EUVD-2026-51093

A flaw was found in the koku-metrics-operator for Red Hat OpenShift. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary upload URL. The operator attaches its own Kubernetes service-account bearer token to queries sent to this...

CVE-2026-18381

The CVE-2026-18381 affects the koku-metrics-operator used with Red Hat OpenShift. A flaw in the CostManagementMetricsConfig custom resource lets an authorized user edit the CR to specify an arbitrary upload URL. The operator then attaches its Kubernetes service-account bearer token to queries sen...

CVE-2026-18381 Project-koku/koku-metrics-operator: koku-metrics-operator: operator service-account token exfiltration via user-controlled prometheus service_address

A flaw was found in the koku-metrics-operator for Red Hat OpenShift. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary upload URL. The operator attaches its own Kubernetes service-account bearer token to queries sent to this...

CVE-2026-18381

A flaw was found in the koku-metrics-operator for Red Hat OpenShift. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary upload URL. The operator attaches its own Kubernetes service-account bearer token to queries sent to this...

CVE-2026-18381

A flaw was found in the koku-metrics-operator for Red Hat OpenShift. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary upload URL. The operator attaches its own Kubernetes service-account bearer token to queries sent to this...

CVE-2026-44097

A low-privileged remote attacker with "operator" access can upload arbitrary files via the REST endpoint intended for firmware updates, resulting in persistent storage of attacker-controlled files and potentially exhausting resources, which might lead to Denial-of-Service...

CLEANSTART-2026-MA89802 Security fixes in minio-operator 6.0.4-r4

Package minio-operator version 6.0.4-r4 fixes 4 vulnerabilities: CVE-2025-30204, ghsa-mh63-6h87-95cp, ghsa-29wx-vh33-7x7r, CVE-2024-51744...

CLEANSTART-2026-ZZ86582 Security fixes in prometheus-operator-fips 0.86.2-r0

Package prometheus-operator-fips version 0.86.2-r0 fixes 2 vulnerabilities: CVE-2025-61727, CVE-2025-61729...

CLEANSTART-2026-UX09480 Security fixes in percona-xtradb-cluster-operator 1.18.0-r2

Package percona-xtradb-cluster-operator version 1.18.0-r2 fixes 1 vulnerabilities: CVE-2026-26958...

CLEANSTART-2026-BC71667 Security fixes in fluent-operator-fips 3.8.0-r0

Package fluent-operator-fips version 3.8.0-r0 fixes 1 vulnerabilities: CVE-2026-39824...

CLEANSTART-2026-IL03064 Security fixes in minio-operator 6.0.4-r3

Package minio-operator version 6.0.4-r3 fixes 4 vulnerabilities: ghsa-mh63-6h87-95cp, ghsa-29wx-vh33-7x7r, CVE-2025-30204, CVE-2024-51744...

CLEANSTART-2026-JP03758 Security fixes in prometheus-operator 0.90.1-r1

Package prometheus-operator version 0.90.1-r1 fixes 3 vulnerabilities: CVE-2026-42504, CVE-2026-42507, CVE-2026-27145...

CLEANSTART-2026-QM93035 Security fixes in opensearch-k8s-operator-fips 2.6.1-r1

Package opensearch-k8s-operator-fips version 2.6.1-r1 fixes 20 vulnerabilities: CVE-2025-47911, CVE-2025-47912, CVE-2025-58183, CVE-2025-58185, CVE-2025-58186...

CLEANSTART-2026-IB41963 Security fixes in percona-xtradb-cluster-operator 1.18.0-r1

Package percona-xtradb-cluster-operator version 1.18.0-r1 fixes 8 vulnerabilities: CVE-2025-61726, CVE-2025-61730, CVE-2025-68121, CVE-2025-61728, CVE-2025-68119...

CLEANSTART-2026-FP77984 Security fixes in strimzi-kafka-operator 0.46.1-r3

Package strimzi-kafka-operator version 0.46.1-r3 fixes 10 vulnerabilities: CVE-2025-11143, CVE-2025-53864, CVE-2025-55163, CVE-2025-58056, CVE-2025-58057...

CLEANSTART-2026-SK73630 Security fixes in minio-operator-fips 6.0.4-r8

Package minio-operator-fips version 6.0.4-r8 fixes 9 vulnerabilities: CVE-2025-61726, CVE-2025-68119, CVE-2025-61728, CVE-2025-68121, CVE-2025-61731...

CLEANSTART-2026-CI65568 Security fixes in minio-operator-fips 7.1.1-r10

Package minio-operator-fips version 7.1.1-r10 fixes 11 vulnerabilities: CVE-2026-39836, CVE-2026-33811, CVE-2026-33814, CVE-2026-42499, CVE-2026-39820...