A flaw in the koku‑metrics‑operator allows a user who can edit the CostManagementMetricsConfig custom resource to specify an arbitrary upload URL. The operator then attaches its own Kubernetes service‑account bearer token to requests sent to that URL, giving the attacker the ability to obtain the token. This is a CWE‑918 data‑exfiltration weakness that can compromise the confidentiality and integrity of cluster resources by providing a credential that can be used to impersonate privileged service accounts.

The vulnerability affects Red Hat Cost Management Metrics Operator deployed on OpenShift. The official vendor name is "Red Hat Cost Management Metrics Operator". No specific version range is provided in the public data, so the applicability extends to all released versions of this operator.

The CVSS score of 7.6 indicates a high severity. The EPSS score of <1% (0.00197) indicates a very low but non‑zero exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attackers need permission to modify the CostManagementMetricsConfig resource, which typically requires cluster‑level or administrator privileges. The flaw therefore relies on privileged or elevated access, but once that is obtained the attacker can effortlessly exfiltrate a service‑account token by pointing the operator to a malicious URL.