CVE-2026-67349: Opencost

High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days.

OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded HELM_VALUES environment variable containing cloud provider credentials. Additionally, adminAuthMiddleware fails open when ADMIN_TOKEN is unset, allowing unauthenticated attackers to modify GCP service account keys via POST /serviceKey to redirect billing calls.

Affected products

• Opencost Opencost: before 1.121.0 (fixed in 1.121.0)

Published 2026-07-30. Last modified 2026-07-31.