Junglewise Threat Intelligence

CVE-2026-67349: OpenCost authentication bypass in helmValues and admin endpoints

CVE-2026-67349 · Severity: high · CVSS 7.5 · Published 2026-07-30

Executive brief

OpenCost, a tool used to monitor Kubernetes cloud costs, contains a security flaw that allows unauthorized access to sensitive information. An attacker could remotely retrieve cloud provider credentials or modify service account keys used for billing. This could lead to the theft of cloud service access or the redirection of billing data, potentially impacting financial operations and data security.

Technical details

OpenCost versions prior to 1.121.0 suffer from two primary authentication failures. First, the 'GET /helmValues' endpoint lacks authentication, exposing the base64-decoded 'HELM_VALUES' environment variable which often contains sensitive cloud provider credentials. Second, the 'adminAuthMiddleware' fails open if the 'ADMIN_TOKEN' environment variable is unset, rather than denying access. This allows unauthenticated attackers to reach administrative endpoints, such as 'POST /serviceKey', where they can modify Google Cloud Platform (GCP) service account keys to redirect billing calls. The issue is resolved in version 1.121.0 by ensuring the middleware fails closed (returning HTTP 503) when no token is configured and applying the middleware to the helmValues endpoint.

Affected products

  • OpenCost OpenCost < 1.121.0

Timeline

  • 2026-07-08: patched: Fix committed to repository
  • 2026-07-20: patched: Version 1.121.0 released
  • 2026-07-30: advisory: NVD and VulnCheck advisories published

References

Related threats