CVE Intelligence

Vulnerabilidades do Opencost Opencost

🔔 Criar alerta RSS Verificador de versão

CVEs publicadas que afetam Opencost Opencost: 1 registro(s), com versões afetadas e correções.

CVE-2026-67349 Alta · 7.5 CWE-306 30/07/2026
OpenCost < 1.121.0 Unauthenticated Helm Values Exposure and Admin Bypass
OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded HELM_VALUES environment variable containing cloud provider credentials. Additionally, adminAuthMiddleware fails open when ADMIN_TOKEN is unset, allowing unauthenticated attackers to modify GCP service account keys via POST /serviceKey to redirect billing calls.