CVE-2026-44300

Name of the Vulnerable Software and Affected Versions OpenCost (affected versions not specified)

Description OpenCost contains an unauthenticated file write issue in the POST /serviceKey endpoint. The AddServiceKey() function in pkg/costmodel/router.go accepts user-supplied data via the key parameter and writes it directly to the GCP service account key file without authentication or input validation. This allows remote attackers to overwrite the key.json file, which can lead to service disruption, credential theft, and potential privilege escalation within Kubernetes clusters. Additionally, the endpoint uses an overly permissive CORS configuration (Access-Control-Allow-Origin: *), which may enable cross-origin attacks if the service is exposed to a user's browser.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider disabling the /serviceKey endpoint if it is not required. Restrict access to the OpenCost service using NetworkPolicies to prevent unauthorized network access. Mount the configuration directory as read-only where possible to prevent file modifications.