CVE-2026-44300

OpenCost provides cost monitoring for Kubernetes workloads and cloud costs. Prior to 1.121.0, the POST /serviceKey endpoint in pkg/costmodel/router.go allows a network client to invoke AddServiceKey without mandatory authentication and submit an arbitrary key form value that is written to the GCP...

CVE-2026-44300 OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection

OpenCost provides cost monitoring for Kubernetes workloads and cloud costs. Prior to 1.121.0, the POST /serviceKey endpoint in pkg/costmodel/router.go allows a network client to invoke AddServiceKey without mandatory authentication and submit an arbitrary key form value that is written to the GCP...

CVE-2026-44300 OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection

OpenCost provides cost monitoring for Kubernetes workloads and cloud costs. Prior to 1.121.0, the POST /serviceKey endpoint in pkg/costmodel/router.go allows a network client to invoke AddServiceKey without mandatory authentication and submit an arbitrary key form value that is written to the GCP...

CVE-2026-44300 OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection

OpenCost provides cost monitoring for Kubernetes workloads and cloud costs. Prior to 1.121.0, the POST /serviceKey endpoint in pkg/costmodel/router.go allows a network client to invoke AddServiceKey without mandatory authentication and submit an arbitrary key form value that is written to the GCP...

EUVD-2026-78874

OpenCost provides cost monitoring for Kubernetes workloads and cloud costs. Prior to 1.121.0, the POST /serviceKey endpoint in pkg/costmodel/router.go allows a network client to invoke AddServiceKey without mandatory authentication and submit an arbitrary key form value that is written to the GCP...

CVE-2026-44300

OpenCost (a Kubernetes cost-monitoring tool) versions prior to 1.121.0 contain an Improper Access Control flaw in the POST /serviceKey endpoint (pkg/costmodel/router.go ). The endpoint invokes AddServiceKey without mandatory authentication, allowing an unauthenticated network client to submit an ...

CVE-2026-44300: Improper Input Validation

OpenCost provides cost monitoring for Kubernetes workloads and cloud costs. Prior to 1.121.0, the POST /serviceKey endpoint in pkg/costmodel/router.go allows a network client to invoke AddServiceKey without mandatory authentication and submit an arbitrary key form value that is written to the GCP...

GO-2026-4569 vulnerabilities

Vulnerabilities for packages: jaeger-fips, gitlab-workhorse-ce-fips, flux-operator, ferretdb, osv-scanner, opencost-fips, flux-operator-fips, opencost, jaeger, datadog-agent, gptscript, github-mcp-server, datadog-agent-fips, gitlab-workhorse-ce...

GO-2026-4773 vulnerabilities

Vulnerabilities for packages: jaeger-fips, gitlab-workhorse-ce-fips, flux-operator, ferretdb, glab, opencost-fips, osv-scanner, flux-operator-fips, livekit-cli, opencost, jaeger, datadog-agent, datadog-agent-fips, gitlab-workhorse-ce...

GO-2026-4770 vulnerabilities

Vulnerabilities for packages: jaeger, opencost, datadog-agent, ferretdb, osv-scanner, glab...

GO-2026-4569 vulnerabilities

Vulnerabilities for packages: jaeger, opencost, github-mcp-server, gptscript, datadog-agent, ferretdb, osv-scanner...

GO-2026-4773 vulnerabilities

Vulnerabilities for packages: jaeger, opencost, datadog-agent, ferretdb, osv-scanner, glab...

CVE-2026-67349

OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded HELMVALUES environment variable containing cloud provider credentials. Additionally, adminAuthMiddleware fails open when ADMINTOKEN is unset, allowing unauthenticated attackers to modify GCP servic...

CVE-2026-67349 OpenCost < 1.121.0 Unauthenticated Helm Values Exposure and Admin Bypass

OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded HELMVALUES environment variable containing cloud provider credentials. Additionally, adminAuthMiddleware fails open when ADMINTOKEN is unset, allowing unauthenticated attackers to modify GCP servic...

CVE-2026-67349

OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded HELMVALUES environment variable containing cloud provider credentials. Additionally, adminAuthMiddleware fails open when ADMINTOKEN is unset, allowing unauthenticated attackers to modify GCP servic...

CVE-2026-67349 OpenCost < 1.121.0 Unauthenticated Helm Values Exposure and Admin Bypass

OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded HELMVALUES environment variable containing cloud provider credentials. Additionally, adminAuthMiddleware fails open when ADMINTOKEN is unset, allowing unauthenticated attackers to modify GCP servic...

CVE-2026-67349

OpenCost before 1.121.0 is vulnerable. The GET /helmValues endpoint does not require authentication, exposing a base64-decoded HELM_VALUES containing cloud provider credentials. Additionally, adminAuthMiddleware is permissive when ADMIN_TOKEN is unset, allowing unauthenticated POST /serviceKey to...

CVE-2026-67349: Missing Authentication for Critical Function

OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded HELMVALUES environment variable containing cloud provider credentials. Additionally, adminAuthMiddleware fails open when ADMINTOKEN is unset, allowing unauthenticated attackers to modify GCP servic...

GO-2026-5974 OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection in github.com/opencost/opencost

OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection in github.com/opencost/opencost...

CVE-2026-44300

creationtimestamp| type| source ---|---|--- 2026-07-14 18:35:05+00:00| published-proof-of-concept| https://github.com/opencost/opencost/security/advisories/GHSA-wmj8-9953-vff5 2026-09-16 06:00:14+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvmhkrkthx24...