PatchSiren

opencost CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH opencost CVE published 2026-07-30

CVE-2026-67349

OpenCost versions before 1.121.0 are vulnerable to credential exposure and unauthorized service account key modifications. The unauthenticated GET /helmValues endpoint exposes base64-decoded HELM_VALUES environment variable containing cloud provider credentials. Additionally, adminAuthMiddleware fails open when ADMIN_TOKEN is unset, allowing unauthenticated attackers to modify GCP service account keys via [truncated]