CVE-2026-67349 in OpenCost
Sumário
de MITRE • 30/07/2026
OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded HELM_VALUES environment variable containing cloud provider credentials. Additionally, adminAuthMiddleware fails open when ADMIN_TOKEN is unset, allowing unauthenticated attackers to modify GCP service account keys via POST /serviceKey to redirect billing calls.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.