CVE-2026-67349: Missing Authentication for Critical Function

OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded HELMVALUES environment variable containing cloud provider credentials. Additionally, adminAuthMiddleware fails open when ADMINTOKEN is unset, allowing unauthenticated attackers to modify GCP servic...

GO-2026-5974 OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection in github.com/opencost/opencost

OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection in github.com/opencost/opencost...

CVE-2026-44300

creationtimestamp| type| source ---|---|--- 2026-07-14 18:35:05+00:00| published-proof-of-concept| https://github.com/opencost/opencost/security/advisories/GHSA-wmj8-9953-vff5 2026-09-16 06:00:14+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvmhkrkthx24...

OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection

Summary OpenCost contains an unauthenticated file write vulnerability in the /serviceKey endpoint that allows remote attackers to overwrite the GCP service account key file without authentication. This can lead to service disruption, credential theft, and potential privilege escalation within...

GHSA-WMJ8-9953-VFF5 OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection

Summary OpenCost contains an unauthenticated file write vulnerability in the /serviceKey endpoint that allows remote attackers to overwrite the GCP service account key file without authentication. This can lead to service disruption, credential theft, and potential privilege escalation within...

PT-2026-59002

Summary OpenCost contains an unauthenticated file write vulnerability in the /serviceKey endpoint that allows remote attackers to overwrite the GCP service account key file without authentication. This can lead to service disruption, credential theft, and potential privilege escalation within...

CVE-2026-33252 vulnerabilities

Vulnerabilities for packages: glab, ferretdb, datadog-agent, opencost, jaeger, osv-scanner...

GHSA-89XV-2J6F-QHC8 vulnerabilities

Vulnerabilities for packages: glab, ferretdb, datadog-agent, opencost, jaeger, osv-scanner...

GHSA-Q382-VC8Q-7JHJ vulnerabilities

Vulnerabilities for packages: glab, ferretdb, datadog-agent, opencost, jaeger, osv-scanner...

GHSA-89XV-2J6F-QHC8 vulnerabilities

Vulnerabilities for packages: livekit-cli, ferretdb, osv-scanner, datadog-agent, jaeger, datadog-agent-fips, opencost, flux-operator-fips, opencost-fips, gitlab-workhorse-ce-fips, glab, flux-operator, gitlab-workhorse-ce, jaeger-fips...

CVE-2026-33252 vulnerabilities

Vulnerabilities for packages: livekit-cli, ferretdb, osv-scanner, datadog-agent, jaeger, datadog-agent-fips, opencost, flux-operator-fips, opencost-fips, gitlab-workhorse-ce-fips, glab, flux-operator, gitlab-workhorse-ce, jaeger-fips...

GHSA-Q382-VC8Q-7JHJ vulnerabilities

Vulnerabilities for packages: livekit-cli, ferretdb, osv-scanner, datadog-agent, jaeger, datadog-agent-fips, opencost, flux-operator-fips, opencost-fips, gitlab-workhorse-ce-fips, glab, flux-operator, gitlab-workhorse-ce, jaeger-fips...

GHSA-J3GX-2473-5FP8 vulnerabilities

Vulnerabilities for packages: azuredisk-csi, podinfo, migrate, neuvector-sigstore-interface, oauth2-proxy, terraform-provider-tls, php-fpmexporter, timestamp-authority, terraform-provider-time, logstash-exporter, rabbitmq-messaging-topology-operator, maru, sbom-convert, mcp-grafana,...

GHSA-RV83-G57W-FR8J vulnerabilities

Vulnerabilities for packages: azuredisk-csi, podinfo, migrate, neuvector-sigstore-interface, oauth2-proxy, terraform-provider-tls, kratos, php-fpmexporter, timestamp-authority, terraform-provider-time, logstash-exporter, rabbitmq-messaging-topology-operator, maru, sbom-convert, mcp-grafana,...

CVE-2026-27139 vulnerabilities

Vulnerabilities for packages: azuredisk-csi, podinfo, migrate, neuvector-sigstore-interface, oauth2-proxy, terraform-provider-tls, kratos, php-fpmexporter, timestamp-authority, terraform-provider-time, logstash-exporter, rabbitmq-messaging-topology-operator, maru, sbom-convert, mcp-grafana,...

CVE-2026-25679 vulnerabilities

Vulnerabilities for packages: azuredisk-csi, podinfo, migrate, neuvector-sigstore-interface, oauth2-proxy, terraform-provider-tls, php-fpmexporter, timestamp-authority, terraform-provider-time, logstash-exporter, rabbitmq-messaging-topology-operator, maru, sbom-convert, mcp-grafana,...

GHSA-J4J7-VW47-RHFQ vulnerabilities

Vulnerabilities for packages: k8s-device-plugin, azuredisk-csi, redpanda, podinfo, migrate, mariadb-operator, neuvector-sigstore-interface, cloudflared, oauth2-proxy, pulumi-language-yaml, kaf, kubernetes-csi-external-snapshotter, terraform-provider-tls, newrelic-infrastructure-agent,...

CVE-2026-27142 vulnerabilities

Vulnerabilities for packages: k8s-device-plugin, azuredisk-csi, redpanda, podinfo, migrate, mariadb-operator, neuvector-sigstore-interface, cloudflared, oauth2-proxy, pulumi-language-yaml, kaf, kubernetes-csi-external-snapshotter, terraform-provider-tls, newrelic-infrastructure-agent,...

CVE-2026-27896 vulnerabilities

Vulnerabilities for packages: gptscript, ferretdb, osv-scanner, datadog-agent, jaeger, datadog-agent-fips, opencost, flux-operator-fips, opencost-fips, gitlab-workhorse-ce-fips, github-mcp-server, flux-operator, gitlab-workhorse-ce, jaeger-fips...

GHSA-WVJ2-96WP-FQ3F vulnerabilities

Vulnerabilities for packages: gptscript, ferretdb, osv-scanner, datadog-agent, jaeger, datadog-agent-fips, opencost, flux-operator-fips, opencost-fips, gitlab-workhorse-ce-fips, github-mcp-server, flux-operator, gitlab-workhorse-ce, jaeger-fips...