CVE-2026-67349

HIGH 7.5

OpenCost < 1.121.0 Unauthenticated Helm Values Exposure and Admin Bypass

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded HELM_VALUES environment variable containing cloud provider credentials. Additionally, adminAuthMiddleware fails open when ADMIN_TOKEN is unset, allowing unauthenticated attackers to modify GCP service account keys via POST /serviceKey to redirect billing calls.

CWE	CWE-306
Vendor	opencost
Product	opencost
Published	Jul 30, 2026

Stay Ahead of the Next One

Get instant alerts for opencost opencost

Be the first to know when new high vulnerabilities affecting opencost opencost are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

opencost / opencost

0 < 1.121.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/opencost/opencost/issues/3893 github.com: https://github.com/opencost/opencost/releases/tag/core/v1.121.0 github.com: https://github.com/opencost/opencost/pull/3910 github.com: https://github.com/opencost/opencost/commit/a49a25bc2e0d6e220a131a4dc58f38ebe6ae851b vulncheck.com: https://www.vulncheck.com/advisories/opencost-unauthenticated-helm-values-exposure-and-admin-bypass

Credits

George Chen