CVE-2026-67349

OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded HELMVALUES environment variable containing cloud provider credentials. Additionally, adminAuthMiddleware fails open when ADMINTOKEN is unset, allowing unauthenticated attackers to modify GCP servic...

CVE-2026-67349 OpenCost < 1.121.0 Unauthenticated Helm Values Exposure and Admin Bypass

OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded HELMVALUES environment variable containing cloud provider credentials. Additionally, adminAuthMiddleware fails open when ADMINTOKEN is unset, allowing unauthenticated attackers to modify GCP servic...

CVE-2026-67349 OpenCost < 1.121.0 Unauthenticated Helm Values Exposure and Admin Bypass

OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded HELMVALUES environment variable containing cloud provider credentials. Additionally, adminAuthMiddleware fails open when ADMINTOKEN is unset, allowing unauthenticated attackers to modify GCP servic...

CVE-2026-67349

OpenCost before 1.121.0 is vulnerable. The GET /helmValues endpoint does not require authentication, exposing a base64-decoded HELM_VALUES containing cloud provider credentials. Additionally, adminAuthMiddleware is permissive when ADMIN_TOKEN is unset, allowing unauthenticated POST /serviceKey to...

GO-2026-5974 OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection in github.com/opencost/opencost

OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection in github.com/opencost/opencost...

CVE-2026-44300

creationtimestamp| type| source ---|---|--- 2026-07-14 18:35:05+00:00| published-proof-of-concept| https://github.com/opencost/opencost/security/advisories/GHSA-wmj8-9953-vff5...

GHSA-WMJ8-9953-VFF5 OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection

Summary OpenCost contains an unauthenticated file write vulnerability in the /serviceKey endpoint that allows remote attackers to overwrite the GCP service account key file without authentication. This can lead to service disruption, credential theft, and potential privilege escalation within...

CVE-2026-33252 vulnerabilities

Vulnerabilities for packages: ferretdb, jaeger, datadog-agent, glab, osv-scanner, opencost...

GHSA-89XV-2J6F-QHC8 vulnerabilities

Vulnerabilities for packages: ferretdb, jaeger, datadog-agent, glab, osv-scanner, opencost...

GHSA-Q382-VC8Q-7JHJ vulnerabilities

Vulnerabilities for packages: ferretdb, jaeger, datadog-agent, glab, osv-scanner, opencost...

GHSA-89XV-2J6F-QHC8 vulnerabilities

Vulnerabilities for packages: opencost-fips, livekit-cli, flux-operator, flux-operator-fips, glab, gitlab-workhorse-ce, jaeger, jaeger-fips, osv-scanner, datadog-agent-fips, opencost, ferretdb, gitlab-workhorse-ce-fips, datadog-agent...

CVE-2026-33252 vulnerabilities

Vulnerabilities for packages: opencost-fips, livekit-cli, flux-operator, flux-operator-fips, glab, gitlab-workhorse-ce, jaeger, jaeger-fips, osv-scanner, datadog-agent-fips, opencost, ferretdb, gitlab-workhorse-ce-fips, datadog-agent...

GHSA-Q382-VC8Q-7JHJ vulnerabilities

Vulnerabilities for packages: opencost-fips, livekit-cli, flux-operator, flux-operator-fips, glab, gitlab-workhorse-ce, jaeger, jaeger-fips, osv-scanner, datadog-agent-fips, opencost, ferretdb, gitlab-workhorse-ce-fips, datadog-agent...

CVE-2026-27142 vulnerabilities

Vulnerabilities for packages: secrets-store-csi-driver-provider-gcp, amazon-cloudwatch-agent-operator, pulumi-language-java, newrelic-infrastructure-agent, flux-image-reflector-controller, pulumi, terraform-provider-pagerduty, spqr, volume-modifier-for-k8s, src,...

GHSA-J4J7-VW47-RHFQ vulnerabilities

Vulnerabilities for packages: secrets-store-csi-driver-provider-gcp, amazon-cloudwatch-agent-operator, pulumi-language-java, newrelic-infrastructure-agent, flux-image-reflector-controller, pulumi, terraform-provider-pagerduty, spqr, volume-modifier-for-k8s, src,...

CVE-2026-25679 vulnerabilities

Vulnerabilities for packages: secrets-store-csi-driver-provider-gcp, kor, spqr, secrets-store-csi-driver-provider-azure, litestream, opentelemetry-collector-contrib, sops, aws-otel-collector, flux-notification-controller, aws-sigv4-proxy, crossplane-provider-aws-kms, cerbos, zarf, kube-rbac-proxy...

GHSA-J3GX-2473-5FP8 vulnerabilities

Vulnerabilities for packages: secrets-store-csi-driver-provider-gcp, kor, spqr, secrets-store-csi-driver-provider-azure, litestream, opentelemetry-collector-contrib, sops, aws-otel-collector, flux-notification-controller, aws-sigv4-proxy, crossplane-provider-aws-kms, cerbos, zarf, kube-rbac-proxy...

CVE-2026-27139 vulnerabilities

Vulnerabilities for packages: secrets-store-csi-driver-provider-gcp, mockgen, kor, spqr, secrets-store-csi-driver-provider-azure, litestream, opentelemetry-collector-contrib, sops, aws-otel-collector, flux-notification-controller, aws-sigv4-proxy, crossplane-provider-aws-kms, cerbos, zarf,...

GHSA-RV83-G57W-FR8J vulnerabilities

Vulnerabilities for packages: secrets-store-csi-driver-provider-gcp, mockgen, kor, spqr, secrets-store-csi-driver-provider-azure, litestream, opentelemetry-collector-contrib, sops, aws-otel-collector, flux-notification-controller, aws-sigv4-proxy, crossplane-provider-aws-kms, cerbos, zarf,...

GHSA-WVJ2-96WP-FQ3F vulnerabilities

Vulnerabilities for packages: opencost-fips, flux-operator, flux-operator-fips, gitlab-workhorse-ce, gptscript, jaeger, jaeger-fips, osv-scanner, datadog-agent-fips, github-mcp-server, opencost, ferretdb, gitlab-workhorse-ce-fips, datadog-agent...