CVE-2026-67349

Name of the Vulnerable Software and Affected Versions OpenCost versions prior to 1.121.0

Description Authentication is not properly enforced for the 'GET /helmValues' endpoint, which exposes the base64-decoded HELM VALUES environment variable containing cloud provider credentials. Furthermore, the adminAuthMiddleware() function fails open when the ADMIN TOKEN variable is unset, enabling unauthenticated users to modify GCP service account keys through the 'POST /serviceKey' endpoint to redirect billing calls.

Recommendations Update to version 1.121.0 or later. Ensure the ADMIN TOKEN variable is properly set to prevent the authentication middleware from failing open.