GO-2026-4569 vulnerabilities

Vulnerabilities for packages: osv-scanner, gitlab-workhorse-ce, datadog-agent-fips, datadog-agent, github-mcp-server, ferretdb, flux-operator, gptscript, jaeger, opencost, flux-operator-fips, gitlab-workhorse-ce-fips, opencost-fips, jaeger-fips...

GO-2026-4773 vulnerabilities

Vulnerabilities for packages: osv-scanner, gitlab-workhorse-ce, datadog-agent-fips, datadog-agent, glab, ferretdb, flux-operator, livekit-cli, jaeger, opencost, flux-operator-fips, gitlab-workhorse-ce-fips, opencost-fips, jaeger-fips...

GO-2026-4770 vulnerabilities

Vulnerabilities for packages: ferretdb, jaeger, opencost, osv-scanner, datadog-agent, glab...

GO-2026-4773 vulnerabilities

Vulnerabilities for packages: ferretdb, jaeger, opencost, osv-scanner, datadog-agent, glab...

GO-2026-4569 vulnerabilities

Vulnerabilities for packages: ferretdb, jaeger, gptscript, opencost, osv-scanner, datadog-agent, github-mcp-server...

CVE-2026-67349

OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded HELMVALUES environment variable containing cloud provider credentials. Additionally, adminAuthMiddleware fails open when ADMINTOKEN is unset, allowing unauthenticated attackers to modify GCP servic...

CVE-2026-67349 OpenCost < 1.121.0 Unauthenticated Helm Values Exposure and Admin Bypass

OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded HELMVALUES environment variable containing cloud provider credentials. Additionally, adminAuthMiddleware fails open when ADMINTOKEN is unset, allowing unauthenticated attackers to modify GCP servic...

CVE-2026-67349 OpenCost < 1.121.0 Unauthenticated Helm Values Exposure and Admin Bypass

OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded HELMVALUES environment variable containing cloud provider credentials. Additionally, adminAuthMiddleware fails open when ADMINTOKEN is unset, allowing unauthenticated attackers to modify GCP servic...

CVE-2026-67349

OpenCost before 1.121.0 is vulnerable. The GET /helmValues endpoint does not require authentication, exposing a base64-decoded HELM_VALUES containing cloud provider credentials. Additionally, adminAuthMiddleware is permissive when ADMIN_TOKEN is unset, allowing unauthenticated POST /serviceKey to...

GO-2026-5974 OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection in github.com/opencost/opencost

OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection in github.com/opencost/opencost...

CVE-2026-44300

creationtimestamp| type| source ---|---|--- 2026-07-14 18:35:05+00:00| published-proof-of-concept| https://github.com/opencost/opencost/security/advisories/GHSA-wmj8-9953-vff5...

OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection

Summary OpenCost contains an unauthenticated file write vulnerability in the /serviceKey endpoint that allows remote attackers to overwrite the GCP service account key file without authentication. This can lead to service disruption, credential theft, and potential privilege escalation within...

GHSA-WMJ8-9953-VFF5 OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection

Summary OpenCost contains an unauthenticated file write vulnerability in the /serviceKey endpoint that allows remote attackers to overwrite the GCP service account key file without authentication. This can lead to service disruption, credential theft, and potential privilege escalation within...

CVE-2026-33252 vulnerabilities

Vulnerabilities for packages: ferretdb, jaeger, opencost, osv-scanner, datadog-agent, glab...

GHSA-Q382-VC8Q-7JHJ vulnerabilities

Vulnerabilities for packages: ferretdb, jaeger, opencost, osv-scanner, datadog-agent, glab...

GHSA-89XV-2J6F-QHC8 vulnerabilities

Vulnerabilities for packages: ferretdb, jaeger, opencost, osv-scanner, datadog-agent, glab...

GHSA-89XV-2J6F-QHC8 vulnerabilities

Vulnerabilities for packages: osv-scanner, gitlab-workhorse-ce, datadog-agent-fips, datadog-agent, glab, ferretdb, flux-operator, livekit-cli, jaeger, opencost, flux-operator-fips, gitlab-workhorse-ce-fips, opencost-fips, jaeger-fips...

GHSA-Q382-VC8Q-7JHJ vulnerabilities

Vulnerabilities for packages: osv-scanner, gitlab-workhorse-ce, datadog-agent-fips, datadog-agent, glab, ferretdb, flux-operator, livekit-cli, jaeger, opencost, flux-operator-fips, gitlab-workhorse-ce-fips, opencost-fips, jaeger-fips...

CVE-2026-33252 vulnerabilities

Vulnerabilities for packages: osv-scanner, gitlab-workhorse-ce, datadog-agent-fips, datadog-agent, glab, ferretdb, flux-operator, livekit-cli, jaeger, opencost, flux-operator-fips, gitlab-workhorse-ce-fips, opencost-fips, jaeger-fips...

GHSA-J4J7-VW47-RHFQ vulnerabilities

Vulnerabilities for packages: kafka-proxy, cloudprober, terraform-provider-sendgrid, prometheus-adapter, apache-exporter, kyverno-policy-reporter-ui, secrets-store-csi-driver-provider-gcp, step-ca, thanos, prometheus-pushgateway, apisix-ingress-controller, kube-metrics-adapter,...