CVE-2026-67349

HighCVSS 7.5

Published: 30/07/2026(UTC)Updated: 31/07/2026(UTC)Translated: 30/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

21th percentile - higher than 21% of all known CVEs

Summary

A vulnerability in OpenCost before version 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded HELM_VALUES environment variable containing cloud provider credentials. Additionally, adminAuthMiddleware fails open when ADMIN_TOKEN is unset, allowing unauthenticated attackers to modify GCP service account keys via POST /serviceKey.

Risk Assessment

An attacker could obtain cloud credentials and take over service accounts, potentially leading to unauthorized access to cloud resources and data leakage.

Recommendation

It is recommended to update OpenCost to version 1.121.0 or later and set the ADMIN_TOKEN environment variable.

Other vulnerabilities in OpenCost

CVE-2026-44300High
OpenCost prior to 1.121.0 exposes the POST /serviceKey endpoint, allowing a network client to invoke AddServiceKey without mandatory authentication and write an arbitrary key value to the GCP service-account key.json file. The attacker controls the file contents but not the directory, filename, or file mode.

Original NVD description (English source)

OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded HELM_VALUES environment variable containing cloud provider credentials. Additionally, adminAuthMiddleware fails open when ADMIN_TOKEN is unset, allowing unauthenticated attackers to modify GCP service account keys via POST /serviceKey to redirect billing calls.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS