CVE-2026-67349 in OpenCost
Summary
by MITRE • 07/30/2026
OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded HELM_VALUES environment variable containing cloud provider credentials. Additionally, adminAuthMiddleware fails open when ADMIN_TOKEN is unset, allowing unauthenticated attackers to modify GCP service account keys via POST /serviceKey to redirect billing calls.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/30/2026
The vulnerability in OpenCost versions prior to 1.121.0 represents a critical authentication bypass that exposes sensitive cloud provider credentials through multiple attack vectors. The primary flaw occurs at the GET /helmValues endpoint where insufficient authentication mechanisms allow any remote attacker to retrieve base64-decoded HELM_VALUES environment variables containing cloud provider credentials. This fundamental failure in access control directly violates security principle of least privilege and creates an immediate exposure of administrative secrets that should remain protected within secure environments.
The technical implementation of this vulnerability stems from inadequate middleware validation where the GET /helmValues endpoint lacks proper authentication checks, enabling unauthorized access to sensitive configuration data. The exposure occurs because the HELM_VALUES environment variables contain base64-encoded cloud credentials that are automatically decoded and returned without verification of requester authorization. This creates a path for attackers to obtain credentials for cloud providers such as aws, azure, or gcp which could then be used to gain access to cloud resources and potentially escalate privileges within the affected infrastructure.
The secondary vulnerability involves the adminAuthMiddleware component which exhibits a dangerous fail-open behavior when the ADMIN_TOKEN environment variable is unset. This configuration error allows attackers to bypass authentication entirely and perform administrative operations without proper authorization. The specific attack vector occurs through the POST /serviceKey endpoint where unauthenticated users can modify GCP service account keys, effectively redirecting billing calls from the legitimate cloud account to attacker-controlled accounts. This represents a severe privilege escalation opportunity that could result in financial loss and unauthorized access to cloud resources.
The operational impact of these vulnerabilities extends beyond immediate credential exposure to encompass potential financial damage through billing manipulation and complete administrative control over cloud resources. Attackers exploiting this vulnerability chain can gain access to cloud provider accounts, potentially leading to unauthorized resource consumption, data breaches, or service disruption. The combination of credential exposure and administrative privilege escalation creates a comprehensive attack surface that could allow adversaries to fully compromise the affected systems and their associated cloud infrastructure.
Organizations should immediately implement mitigations including mandatory authentication enforcement for all administrative endpoints, proper validation of environment variables, and implementation of secure access controls for configuration endpoints. The vulnerability aligns with CWE-284 (Improper Access Control) and CWE-312 (Sensitive Data Exposure) while potentially mapping to ATT&CK technique T1566 (Phishing) for initial access and T1078 (Valid Accounts) for privilege escalation. Security teams must ensure that all environment variables containing sensitive data are properly secured and that authentication mechanisms cannot be bypassed through configuration errors, particularly in cloud-native applications where misconfigurations can have severe financial implications.
The root cause analysis reveals fundamental security design flaws in the application's authentication framework and environment variable handling processes. The fail-open behavior of adminAuthMiddleware demonstrates poor defensive programming practices where system security relies on proper configuration rather than robust default security settings. This vulnerability underscores the importance of implementing principle of least privilege, secure by default configurations, and comprehensive access control mechanisms in cloud-native applications to prevent unauthorized access to sensitive operational data and administrative functions.
Mitigation strategies should include immediate patching to version 1.121.0 or later, mandatory configuration validation for environment variables, implementation of proper authentication for all endpoints, and regular security auditing of application access controls. Organizations must also establish monitoring for unauthorized access attempts to administrative endpoints and implement robust credential management practices that prevent sensitive data exposure through API responses. The vulnerability serves as a reminder of the critical importance of secure configuration management in distributed systems where misconfigurations can lead to complete system compromise and financial loss through cloud resource misuse.