GO-2026-5974 OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection in github.com/opencost/opencost

OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection in github.com/opencost/opencost...

CVE-2026-44300

creationtimestamp| type| source ---|---|--- 2026-07-14 18:35:05+00:00| published-proof-of-concept| https://github.com/opencost/opencost/security/advisories/GHSA-wmj8-9953-vff5...

GHSA-WMJ8-9953-VFF5 OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection

Summary OpenCost contains an unauthenticated file write vulnerability in the /serviceKey endpoint that allows remote attackers to overwrite the GCP service account key file without authentication. This can lead to service disruption, credential theft, and potential privilege escalation within...

CVE-2026-33252 vulnerabilities

Vulnerabilities for packages: osv-scanner, opencost, glab, datadog-agent, ferretdb, jaeger...

GHSA-89XV-2J6F-QHC8 vulnerabilities

Vulnerabilities for packages: osv-scanner, opencost, glab, datadog-agent, ferretdb, jaeger...

GHSA-Q382-VC8Q-7JHJ vulnerabilities

Vulnerabilities for packages: osv-scanner, opencost, glab, datadog-agent, ferretdb, jaeger...

GHSA-89XV-2J6F-QHC8 vulnerabilities

Vulnerabilities for packages: opencost, jaeger-fips, livekit-cli, osv-scanner, ferretdb, gitlab-workhorse-ce-fips, flux-operator, flux-operator-fips, datadog-agent-fips, jaeger, datadog-agent, opencost-fips, glab, gitlab-workhorse-ce...

GHSA-Q382-VC8Q-7JHJ vulnerabilities

Vulnerabilities for packages: opencost, jaeger-fips, livekit-cli, osv-scanner, ferretdb, gitlab-workhorse-ce-fips, flux-operator, flux-operator-fips, datadog-agent-fips, jaeger, datadog-agent, opencost-fips, glab, gitlab-workhorse-ce...

CVE-2026-33252 vulnerabilities

Vulnerabilities for packages: opencost, jaeger-fips, livekit-cli, osv-scanner, ferretdb, gitlab-workhorse-ce-fips, flux-operator, flux-operator-fips, datadog-agent-fips, jaeger, datadog-agent, opencost-fips, glab, gitlab-workhorse-ce...

GHSA-RV83-G57W-FR8J vulnerabilities

Vulnerabilities for packages: local-static-provisioner, actions-runner-controller, render-template, wgcf, sriov-network-device-plugin, rancher, kubernetes-csi-external-snapshotter, terraform-provider-azuread, sealed-secrets, rancher-system-upgrade-controller, azcopy, containerd, chartmuseum,...

GHSA-J4J7-VW47-RHFQ vulnerabilities

Vulnerabilities for packages: docker-compose, k8s-device-plugin, kafka-proxy, kubernetes-dns-node-cache, terraform-provider-random, verticadb-operator, kaf, crossplane-provider-aws-lambda, cluster-api-azure-controller, rancher-agent, kyverno-policy-reporter-ui, tempo, sqlexporter, steampipe,...

CVE-2026-25679 vulnerabilities

Vulnerabilities for packages: local-static-provisioner, actions-runner-controller, wgcf, sriov-network-device-plugin, rancher, kubernetes-csi-external-snapshotter, terraform-provider-azuread, sealed-secrets, rancher-system-upgrade-controller, azcopy, containerd, chartmuseum,...

CVE-2026-27139 vulnerabilities

Vulnerabilities for packages: local-static-provisioner, actions-runner-controller, render-template, wgcf, sriov-network-device-plugin, rancher, kubernetes-csi-external-snapshotter, terraform-provider-azuread, sealed-secrets, rancher-system-upgrade-controller, azcopy, containerd, chartmuseum,...

GHSA-J3GX-2473-5FP8 vulnerabilities

Vulnerabilities for packages: local-static-provisioner, actions-runner-controller, wgcf, sriov-network-device-plugin, rancher, kubernetes-csi-external-snapshotter, terraform-provider-azuread, sealed-secrets, rancher-system-upgrade-controller, azcopy, containerd, chartmuseum,...

CVE-2026-27142 vulnerabilities

Vulnerabilities for packages: docker-compose, k8s-device-plugin, kafka-proxy, kubernetes-dns-node-cache, terraform-provider-random, verticadb-operator, kaf, crossplane-provider-aws-lambda, cluster-api-azure-controller, rancher-agent, kyverno-policy-reporter-ui, tempo, sqlexporter, steampipe,...

GHSA-WVJ2-96WP-FQ3F vulnerabilities

Vulnerabilities for packages: jaeger-fips, osv-scanner, ferretdb, gitlab-workhorse-ce-fips, flux-operator, flux-operator-fips, github-mcp-server, datadog-agent-fips, jaeger, gptscript, datadog-agent, opencost-fips, opencost, gitlab-workhorse-ce...

CVE-2026-27896 vulnerabilities

Vulnerabilities for packages: jaeger-fips, osv-scanner, ferretdb, gitlab-workhorse-ce-fips, flux-operator, flux-operator-fips, github-mcp-server, datadog-agent-fips, jaeger, gptscript, datadog-agent, opencost-fips, opencost, gitlab-workhorse-ce...

CVE-2025-22871 vulnerabilities

Vulnerabilities for packages: nerdctl, local-static-provisioner, ghaudit, actions-runner-controller, render-template, aws-network-policy-agent, fluent-operator, wgcf, cargobump, docker-cli-buildx, sriov-network-device-plugin, gostatsd, sealed-secrets, helm-operator, azcopy, containerd, chartmuseu...

GHSA-G9PC-8G42-G6VQ vulnerabilities

Vulnerabilities for packages: nerdctl, local-static-provisioner, ghaudit, actions-runner-controller, render-template, aws-network-policy-agent, fluent-operator, wgcf, cargobump, docker-cli-buildx, sriov-network-device-plugin, gostatsd, sealed-secrets, helm-operator, azcopy, containerd, chartmuseu...

CVE-2025-22871 vulnerabilities

Vulnerabilities for packages: rabbitmq-cluster-operator, opentelemetry-collector-fips, aws-application-networking-k8s, kyverno-policy-reporter, grafana-mimir, nri-apache, step, seaweedfs, pombump, flux-source-controller-fips, google-guest-agent-manager, memcached-exporter, argo-workflows,...