Executive brief
OpenCost, a tool used for monitoring Kubernetes infrastructure costs, contains a security flaw in its service key management endpoint. An unauthenticated attacker can remotely overwrite the Google Cloud Platform (GCP) service account credentials used by the system. This can lead to a complete disruption of cost monitoring services or allow an attacker to redirect sensitive billing data to their own accounts.
Technical details
An unauthenticated file write vulnerability exists in OpenCost's `AddServiceKey` function within `pkg/costmodel/router.go`. The `/serviceKey` endpoint accepts POST requests and writes the 'key' parameter directly to the GCP authentication secret file path (typically key.json) without verifying the caller's identity or validating the input format. An attacker can exploit this to overwrite legitimate cloud credentials with malicious or malformed data. Additionally, overly permissive CORS headers (Access-Control-Allow-Origin: *) facilitate exploitation via cross-origin requests if the service is accessible to a user's browser. The vulnerability is patched in version 1.119.1.
Affected products
- OpenCost OpenCost < 1.119.1
Timeline
- 2026-07-14: disclosed
- 2026-07-14: advisory
- 2026-07-14: patched: Fixed in version 1.119.1