GO-2026-4569 vulnerabilities

Vulnerabilities for packages: ferretdb, jaeger-fips, flux-operator, opencost, opencost-fips, jaeger, flux-operator-fips, datadog-agent-fips, osv-scanner, gptscript, datadog-agent, github-mcp-server, gitlab-workhorse-ce, gitlab-workhorse-ce-fips...

GO-2026-4773 vulnerabilities

Vulnerabilities for packages: ferretdb, jaeger-fips, flux-operator, opencost-fips, livekit-cli, glab, jaeger, flux-operator-fips, datadog-agent-fips, osv-scanner, datadog-agent, gitlab-workhorse-ce-fips, gitlab-workhorse-ce, opencost...

GO-2026-4770 vulnerabilities

Vulnerabilities for packages: ferretdb, jaeger, datadog-agent, opencost, glab, osv-scanner...

GO-2026-4569 vulnerabilities

Vulnerabilities for packages: ferretdb, jaeger, osv-scanner, datadog-agent, opencost, gptscript, github-mcp-server...

GO-2026-4773 vulnerabilities

Vulnerabilities for packages: ferretdb, jaeger, datadog-agent, opencost, glab, osv-scanner...

CVE-2026-67349

OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded HELMVALUES environment variable containing cloud provider credentials. Additionally, adminAuthMiddleware fails open when ADMINTOKEN is unset, allowing unauthenticated attackers to modify GCP servic...

CVE-2026-67349

OpenCost before 1.121.0 is vulnerable. The GET /helmValues endpoint does not require authentication, exposing a base64-decoded HELM_VALUES containing cloud provider credentials. Additionally, adminAuthMiddleware is permissive when ADMIN_TOKEN is unset, allowing unauthenticated POST /serviceKey to...

CVE-2026-67349 OpenCost < 1.121.0 Unauthenticated Helm Values Exposure and Admin Bypass

OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded HELMVALUES environment variable containing cloud provider credentials. Additionally, adminAuthMiddleware fails open when ADMINTOKEN is unset, allowing unauthenticated attackers to modify GCP servic...

CVE-2026-67349 OpenCost < 1.121.0 Unauthenticated Helm Values Exposure and Admin Bypass

OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded HELMVALUES environment variable containing cloud provider credentials. Additionally, adminAuthMiddleware fails open when ADMINTOKEN is unset, allowing unauthenticated attackers to modify GCP servic...

GO-2026-5974 OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection in github.com/opencost/opencost

OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection in github.com/opencost/opencost...

CVE-2026-44300

creationtimestamp| type| source ---|---|--- 2026-07-14 18:35:05+00:00| published-proof-of-concept| https://github.com/opencost/opencost/security/advisories/GHSA-wmj8-9953-vff5...

OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection

Summary OpenCost contains an unauthenticated file write vulnerability in the /serviceKey endpoint that allows remote attackers to overwrite the GCP service account key file without authentication. This can lead to service disruption, credential theft, and potential privilege escalation within...

GHSA-WMJ8-9953-VFF5 OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection

Summary OpenCost contains an unauthenticated file write vulnerability in the /serviceKey endpoint that allows remote attackers to overwrite the GCP service account key file without authentication. This can lead to service disruption, credential theft, and potential privilege escalation within...

CVE-2026-33252 vulnerabilities

Vulnerabilities for packages: ferretdb, jaeger, datadog-agent, opencost, glab, osv-scanner...

GHSA-Q382-VC8Q-7JHJ vulnerabilities

Vulnerabilities for packages: ferretdb, jaeger, datadog-agent, opencost, glab, osv-scanner...

GHSA-89XV-2J6F-QHC8 vulnerabilities

Vulnerabilities for packages: ferretdb, jaeger, datadog-agent, opencost, glab, osv-scanner...

GHSA-89XV-2J6F-QHC8 vulnerabilities

Vulnerabilities for packages: ferretdb, jaeger-fips, flux-operator, opencost-fips, livekit-cli, glab, jaeger, flux-operator-fips, datadog-agent-fips, osv-scanner, datadog-agent, gitlab-workhorse-ce-fips, gitlab-workhorse-ce, opencost...

CVE-2026-33252 vulnerabilities

Vulnerabilities for packages: ferretdb, jaeger-fips, flux-operator, opencost-fips, livekit-cli, glab, jaeger, flux-operator-fips, datadog-agent-fips, osv-scanner, datadog-agent, gitlab-workhorse-ce-fips, gitlab-workhorse-ce, opencost...

GHSA-Q382-VC8Q-7JHJ vulnerabilities

Vulnerabilities for packages: ferretdb, jaeger-fips, flux-operator, opencost-fips, livekit-cli, glab, jaeger, flux-operator-fips, datadog-agent-fips, osv-scanner, datadog-agent, gitlab-workhorse-ce-fips, gitlab-workhorse-ce, opencost...

CVE-2026-27142 vulnerabilities

Vulnerabilities for packages: terraform-provider-kubernetes, promxy, cluster-api-gcp-controller, kafka-proxy, falco-no-driver, grafana-rollout-operator, memcached-exporter, kubescape, prometheus-pushgateway, boring-registry, crossplane-provider-aws-cloudfront, cert-manager,...