CyberSecBulletin

Opencost vulnerabilities

We track 2 vulnerabilities in Opencost products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on September 15, 2026.

2vulnerabilities
0critical
2high
0exploited
8.2average CVSS score

Latest Opencost vulnerabilities

  • 8.8 High severity

    OpenCost provides cost monitoring for Kubernetes workloads and cloud costs.

    CVE-2026-44300Opencost

    OpenCost provides cost monitoring for Kubernetes workloads and cloud costs. Prior to 1.121.0, the POST /serviceKey endpoint in pkg/costmodel/router.go allows a network client to invoke AddServiceKey without mandatory authentication and submit an arbitrary key

  • 7.5 High severity

    opencost: Missing Authentication for Critical Functionality

    CVE-2026-67349Opencost

    OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded HELM_VALUES environment variable containing cloud provider credentials. Additionally, adminAuthMiddleware fails open when ADMIN_TOKEN is unset, allowing unauthe