43 matches found
GO-2026-6609 vulnerabilities
Vulnerabilities for packages: k8s-device-plugin, k6, rclone, argo-cd, chartmuseum, kyverno-policy-reporter-ui, terragrunt, prometheus-adapter, spire-server, grafana-pyroscope, grafana-alloy, continuity, zarf, external-dns, headlamp, karpenter, grafana, temporal-ui-server, mesosphere-vsphere-csi,...
GHSA-F4XW-M386-M277 vulnerabilities
Vulnerabilities for packages: k8s-device-plugin, k6, rclone, argo-cd, chartmuseum, kyverno-policy-reporter-ui, terragrunt, prometheus-adapter, spire-server, grafana-pyroscope, grafana-alloy, continuity, zarf, external-dns, headlamp, karpenter, grafana, temporal-ui-server, mesosphere-vsphere-csi,...
CVE-2026-78667 vulnerabilities
Vulnerabilities for packages: k8s-device-plugin, k6, rclone, argo-cd, chartmuseum, kyverno-policy-reporter-ui, terragrunt, prometheus-adapter, spire-server, grafana-pyroscope, grafana-alloy, continuity, zarf, external-dns, headlamp, karpenter, grafana, temporal-ui-server, mesosphere-vsphere-csi,...
CVE-2026-44300
OpenCost provides cost monitoring for Kubernetes workloads and cloud costs. Prior to 1.121.0, the POST /serviceKey endpoint in pkg/costmodel/router.go allows a network client to invoke AddServiceKey without mandatory authentication and submit an arbitrary key form value that is written to the GCP...
CVE-2026-44300 OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection
OpenCost provides cost monitoring for Kubernetes workloads and cloud costs. Prior to 1.121.0, the POST /serviceKey endpoint in pkg/costmodel/router.go allows a network client to invoke AddServiceKey without mandatory authentication and submit an arbitrary key form value that is written to the GCP...
CVE-2026-44300 OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection
OpenCost provides cost monitoring for Kubernetes workloads and cloud costs. Prior to 1.121.0, the POST /serviceKey endpoint in pkg/costmodel/router.go allows a network client to invoke AddServiceKey without mandatory authentication and submit an arbitrary key form value that is written to the GCP...
EUVD-2026-78874
OpenCost provides cost monitoring for Kubernetes workloads and cloud costs. Prior to 1.121.0, the POST /serviceKey endpoint in pkg/costmodel/router.go allows a network client to invoke AddServiceKey without mandatory authentication and submit an arbitrary key form value that is written to the GCP...
CVE-2026-44300
OpenCost (a Kubernetes cost-monitoring tool) versions prior to 1.121.0 contain an Improper Access Control flaw in the POST /serviceKey endpoint (pkg/costmodel/router.go ). The endpoint invokes AddServiceKey without mandatory authentication, allowing an unauthenticated network client to submit an ...
CVE-2026-44300 OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection
OpenCost provides cost monitoring for Kubernetes workloads and cloud costs. Prior to 1.121.0, the POST /serviceKey endpoint in pkg/costmodel/router.go allows a network client to invoke AddServiceKey without mandatory authentication and submit an arbitrary key form value that is written to the GCP...
CVE-2026-44300: Improper Input Validation
OpenCost provides cost monitoring for Kubernetes workloads and cloud costs. Prior to 1.121.0, the POST /serviceKey endpoint in pkg/costmodel/router.go allows a network client to invoke AddServiceKey without mandatory authentication and submit an arbitrary key form value that is written to the GCP...
GO-2026-4773 vulnerabilities
Vulnerabilities for packages: livekit-cli, ferretdb, osv-scanner, datadog-agent, jaeger, datadog-agent-fips, opencost, flux-operator-fips, opencost-fips, gitlab-workhorse-ce-fips, glab, flux-operator, gitlab-workhorse-ce, jaeger-fips...
GO-2026-4569 vulnerabilities
Vulnerabilities for packages: gptscript, ferretdb, osv-scanner, datadog-agent, jaeger, datadog-agent-fips, opencost, flux-operator-fips, opencost-fips, gitlab-workhorse-ce-fips, github-mcp-server, flux-operator, gitlab-workhorse-ce, jaeger-fips...
GO-2026-4569 vulnerabilities
Vulnerabilities for packages: ferretdb, datadog-agent, gptscript, github-mcp-server, opencost, jaeger, osv-scanner...
GO-2026-4770 vulnerabilities
Vulnerabilities for packages: glab, ferretdb, datadog-agent, opencost, jaeger, osv-scanner...
GO-2026-4773 vulnerabilities
Vulnerabilities for packages: glab, ferretdb, datadog-agent, opencost, jaeger, osv-scanner...
CVE-2026-67349
OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded HELMVALUES environment variable containing cloud provider credentials. Additionally, adminAuthMiddleware fails open when ADMINTOKEN is unset, allowing unauthenticated attackers to modify GCP servic...
CVE-2026-67349
OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded HELMVALUES environment variable containing cloud provider credentials. Additionally, adminAuthMiddleware fails open when ADMINTOKEN is unset, allowing unauthenticated attackers to modify GCP servic...
CVE-2026-67349
OpenCost before 1.121.0 is vulnerable. The GET /helmValues endpoint does not require authentication, exposing a base64-decoded HELM_VALUES containing cloud provider credentials. Additionally, adminAuthMiddleware is permissive when ADMIN_TOKEN is unset, allowing unauthenticated POST /serviceKey to...
CVE-2026-67349 OpenCost < 1.121.0 Unauthenticated Helm Values Exposure and Admin Bypass
OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded HELMVALUES environment variable containing cloud provider credentials. Additionally, adminAuthMiddleware fails open when ADMINTOKEN is unset, allowing unauthenticated attackers to modify GCP servic...
CVE-2026-67349 OpenCost < 1.121.0 Unauthenticated Helm Values Exposure and Admin Bypass
OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded HELMVALUES environment variable containing cloud provider credentials. Additionally, adminAuthMiddleware fails open when ADMINTOKEN is unset, allowing unauthenticated attackers to modify GCP servic...