CVE-2026-67349 OpenCost < 1.121.0 Unauthenticated Helm Values Exposure and Admin Bypass

OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded HELMVALUES environment variable containing cloud provider credentials. Additionally, adminAuthMiddleware fails open when ADMINTOKEN is unset, allowing unauthenticated attackers to modify GCP servic...

Improper Access Control

OpenCost is vulnerable to Improper Access Control. The vulnerability is due to missing authentication in the /serviceKey endpoint, which allows an attacker to overwrite the GCP service account key file remotely, leading to service disruption, credential theft, and potential privilege escalation...

Use of Password System for Primary Authentication

Overview Affected versions of this package are vulnerable to Use of Password System for Primary Authentication via the AddServiceKey function. An attacker can overwrite sensitive credential files and inject malicious content by sending unauthenticated POST requests to the /serviceKey endpoint,...