A critical Server-Side Request Forgery vulnerability in the Red Hat Cost Management Metrics Operator permits authenticated users to steal sensitive cluster credentials.

The CostManagementMetricsConfig custom resource allows a user with edit permissions to specify an arbitrary upload URL. When the authentication type is set to token, the operator attaches the cluster-global Red Hat Cloud pull-secret bearer token to HTTP requests sent to the user-controlled URL.

Successful exploitation allows an authenticated attacker to obtain sensitive cluster-global credentials, potentially leading to unauthorized access to cloud resources and infrastructure. With a CVSS score of 7.6, this vulnerability poses a significant risk to the integrity and confidentiality of the environment.

Immediate Action: Apply vendor security updates as soon as they become available. Until a patch is released, restrict edit permissions on the CostManagementMetricsConfig custom resource to highly trusted administrators only.

Proactive Monitoring: Review audit logs for suspicious or unauthorized modifications to CostManagementMetricsConfig resources. Monitor egress traffic from the operator for connections to unknown or unauthorized external URLs.

Compensating Controls: Utilize network policies to restrict the operator from making arbitrary outbound connections to untrusted external domains.

Public Exploit Available: No (unknown)

This vulnerability represents a high risk to cluster security by exposing sensitive bearer tokens. Administrators should prioritize identifying instances where edit permissions are granted for the affected custom resource and restrict access to minimize the attack surface until an official patch is deployed.