CVE-2026-67349: Missing Authentication for Critical Function

OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded HELMVALUES environment variable containing cloud provider credentials. Additionally, adminAuthMiddleware fails open when ADMINTOKEN is unset, allowing unauthenticated attackers to modify GCP servic...

GO-2026-5974 OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection in github.com/opencost/opencost

OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection in github.com/opencost/opencost...

CVE-2026-44300

creationtimestamp| type| source ---|---|--- 2026-07-14 18:35:05+00:00| published-proof-of-concept| https://github.com/opencost/opencost/security/advisories/GHSA-wmj8-9953-vff5 2026-09-16 06:00:14+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvmhkrkthx24...

OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection

Summary OpenCost contains an unauthenticated file write vulnerability in the /serviceKey endpoint that allows remote attackers to overwrite the GCP service account key file without authentication. This can lead to service disruption, credential theft, and potential privilege escalation within...

GHSA-WMJ8-9953-VFF5 OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection

Summary OpenCost contains an unauthenticated file write vulnerability in the /serviceKey endpoint that allows remote attackers to overwrite the GCP service account key file without authentication. This can lead to service disruption, credential theft, and potential privilege escalation within...

PT-2026-59002

Summary OpenCost contains an unauthenticated file write vulnerability in the /serviceKey endpoint that allows remote attackers to overwrite the GCP service account key file without authentication. This can lead to service disruption, credential theft, and potential privilege escalation within...

CVE-2026-33252 vulnerabilities

Vulnerabilities for packages: jaeger, ferretdb, glab, osv-scanner, datadog-agent, opencost...

GHSA-89XV-2J6F-QHC8 vulnerabilities

Vulnerabilities for packages: jaeger, ferretdb, glab, osv-scanner, datadog-agent, opencost...

GHSA-Q382-VC8Q-7JHJ vulnerabilities

Vulnerabilities for packages: jaeger, ferretdb, glab, osv-scanner, datadog-agent, opencost...

CVE-2026-33252 vulnerabilities

Vulnerabilities for packages: jaeger, flux-operator, jaeger-fips, glab, osv-scanner, gitlab-workhorse-ce-fips, gitlab-workhorse-ce, livekit-cli, opencost-fips, flux-operator-fips, datadog-agent, opencost, datadog-agent-fips, ferretdb...

GHSA-89XV-2J6F-QHC8 vulnerabilities

Vulnerabilities for packages: jaeger, flux-operator, jaeger-fips, glab, osv-scanner, gitlab-workhorse-ce-fips, gitlab-workhorse-ce, livekit-cli, opencost-fips, flux-operator-fips, datadog-agent, opencost, datadog-agent-fips, ferretdb...

GHSA-Q382-VC8Q-7JHJ vulnerabilities

Vulnerabilities for packages: jaeger, flux-operator, jaeger-fips, glab, osv-scanner, gitlab-workhorse-ce-fips, gitlab-workhorse-ce, livekit-cli, opencost-fips, flux-operator-fips, datadog-agent, opencost, datadog-agent-fips, ferretdb...

CVE-2026-25679 vulnerabilities

Vulnerabilities for packages: gitness, cluster-api-provider-vsphere, kubernetes-csi-node-driver-registrar, nri-jmx, kube-rbac-proxy, rancher-machine, tempo, logstash-exporter, snyk-cli, nats, nfpm, crossplane-provider-aws-rds, terraform-provider-pagerduty, rancher-telemetry, openbao-k8s,...

GHSA-J3GX-2473-5FP8 vulnerabilities

Vulnerabilities for packages: gitness, cluster-api-provider-vsphere, kubernetes-csi-node-driver-registrar, nri-jmx, kube-rbac-proxy, rancher-machine, tempo, logstash-exporter, snyk-cli, nats, nfpm, crossplane-provider-aws-rds, terraform-provider-pagerduty, rancher-telemetry, openbao-k8s,...

CVE-2026-27139 vulnerabilities

Vulnerabilities for packages: gitness, cluster-api-provider-vsphere, kubernetes-csi-node-driver-registrar, nri-jmx, kube-rbac-proxy, rancher-machine, tempo, logstash-exporter, snyk-cli, nats, nfpm, crossplane-provider-aws-rds, terraform-provider-pagerduty, rancher-telemetry, openbao-k8s,...

GHSA-RV83-G57W-FR8J vulnerabilities

Vulnerabilities for packages: gitness, cluster-api-provider-vsphere, kubernetes-csi-node-driver-registrar, nri-jmx, kube-rbac-proxy, rancher-machine, tempo, logstash-exporter, snyk-cli, nats, nfpm, crossplane-provider-aws-rds, terraform-provider-pagerduty, rancher-telemetry, openbao-k8s,...

GHSA-J4J7-VW47-RHFQ vulnerabilities

Vulnerabilities for packages: tflint, volume-modifier-for-k8s, gitness, gitlab-kas, mariadb-operator, terraform-provider-time, oauth2-proxy, kubernetes-dashboard, terraform-provider-google, cluster-api-provider-vsphere, kubernetes-csi-node-driver-registrar, kyverno, terraform-provider-kubernetes,...

CVE-2026-27142 vulnerabilities

Vulnerabilities for packages: tflint, volume-modifier-for-k8s, gitness, gitlab-kas, mariadb-operator, terraform-provider-time, oauth2-proxy, kubernetes-dashboard, terraform-provider-google, cluster-api-provider-vsphere, kubernetes-csi-node-driver-registrar, kyverno, terraform-provider-kubernetes,...

CVE-2026-27896 vulnerabilities

Vulnerabilities for packages: jaeger, flux-operator, jaeger-fips, osv-scanner, gitlab-workhorse-ce-fips, gitlab-workhorse-ce, opencost-fips, flux-operator-fips, datadog-agent, opencost, datadog-agent-fips, gptscript, ferretdb, github-mcp-server...

GHSA-WVJ2-96WP-FQ3F vulnerabilities

Vulnerabilities for packages: jaeger, flux-operator, jaeger-fips, osv-scanner, gitlab-workhorse-ce-fips, gitlab-workhorse-ce, opencost-fips, flux-operator-fips, datadog-agent, opencost, datadog-agent-fips, gptscript, ferretdb, github-mcp-server...