PatchSiren cyber security CVE debrief
CVE-2026-67349 opencost CVE debrief
OpenCost versions before 1.121.0 are vulnerable to credential exposure and unauthorized service account key modifications. The unauthenticated GET /helmValues endpoint exposes base64-decoded HELM_VALUES environment variable containing cloud provider credentials. Additionally, adminAuthMiddleware fails open when ADMIN_TOKEN is unset, allowing unauthenticated attackers to modify GCP service account keys via POST /serviceKey, potentially redirecting billing calls. OpenCost users, administrators, and security teams should be aware of this vulnerability and take immediate action to patch or mitigate it. AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-30T15:16:36.900Z and has not been modified since then.
- Vendor
- opencost
- Product
- Unknown
- CVSS
- HIGH 8.7
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-07-30
- Original CVE updated
- 2026-07-31
- Advisory published
- 2026-07-30
- Advisory updated
- 2026-07-31
Who should care
OpenCost users, administrators, and security teams should be aware of this vulnerability. Anyone using OpenCost versions before 1.121.0 should take immediate action to patch or mitigate the vulnerability to prevent potential credential exposure and unauthorized service account key modifications.
Technical summary
CVE-2026-67349 affects OpenCost versions before 1.121.0. The vulnerability has two main issues: 1) The GET /helmValues endpoint is unauthenticated, exposing base64-decoded HELM_VALUES environment variable containing cloud provider credentials. 2) The adminAuthMiddleware fails open when the ADMIN_TOKEN environment variable is unset, allowing unauthenticated attackers to modify GCP service account keys via a POST request to /serviceKey. This could potentially allow attackers to redirect billing calls.
Defensive priority
OpenCost users should prioritize patching to prevent potential credential exposure and unauthorized service account key modifications.
Recommended defensive actions
- Patch OpenCost to version 1.121.0 or later
- Review and update the ADMIN_TOKEN environment variable
- Monitor for unauthorized access to the /helmValues endpoint
- Restrict modifications to GCP service account keys
- Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
- Review compensating controls for exposed systems while remediation is scheduled and verified.
- Check relevant monitoring, detection, and logs for exposed assets that need extra review.
Evidence notes
The CVE description indicates that OpenCost before version 1.121.0 has an unauthenticated GET /helmValues endpoint, exposing base64-decoded HELM_VALUES environment variable containing cloud provider credentials. Additionally, adminAuthMiddleware fails open when ADMIN_TOKEN is unset, allowing unauthenticated attackers to modify GCP service account keys via POST /serviceKey. However, detailed information about affected versions, vendor statements, or user impact is limited in the provided source corpus.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-30T15:16:36.900Z and has not been modified since then.