Skip to content
OpenAdvisories

Vendor

opencost

2 known vulnerabilities.

Products

opencost 2
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.8
    CVE-2026-44300

    OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection

    OpenCost provides cost monitoring for Kubernetes workloads and cloud costs. Prior to 1.121.0, the POST /serviceKey endpoint in pkg/costmodel/router.go allows a network client to invoke AddServiceKey without mandatory authentication and submit an arbitrary key…

    opencost opencost github.com/opencost/opencost Go
  • High 7.5
    CVE-2026-67349

    OpenCost < 1.121.0 Unauthenticated Helm Values Exposure and Admin Bypass

    OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded HELM_VALUES environment variable containing cloud provider credentials. Additionally, adminAuthMiddleware fails open when ADMIN_TOKEN is unset, allowing unauth…

    opencost opencost