A critical Server-Side Request Forgery vulnerability in the Red Hat Cost Management Metrics Operator permits authenticated attackers to compromise Kubernetes service-account tokens.

The CostManagementMetricsConfig custom resource allows a user with edit permissions to specify an arbitrary upload URL. The operator insecurely attaches its Kubernetes service-account bearer token to queries sent to this user-controlled URL, enabling token theft.

Exploitation of this flaw allows an attacker to gain the permissions associated with the operator's service account, potentially leading to unauthorized control over cluster resources. Given the CVSS score of 7.6, this is a high-severity issue that could facilitate lateral movement within the OpenShift environment.

Immediate Action: Limit edit permissions on the CostManagementMetricsConfig custom resource to trusted users immediately. Monitor vendor security channels for the release of an official patch.

Proactive Monitoring: Monitor API server logs for modifications to the CostManagementMetricsConfig resource. Inspect outbound network requests originating from the operator pod for anomalous traffic patterns.

Compensating Controls: Implement egress filtering to prevent the operator from communicating with unauthorized or external endpoints.

Public Exploit Available: No (unknown)

The risk of privilege escalation via token theft necessitates immediate administrative intervention. Organizations should audit their current RBAC policies to ensure that only authorized personnel can modify configuration objects related to the Cost Management Metrics Operator.