OpenCost CVE-2026-67349

Exploitation requires network reachability to the OpenCost cost-model API and, for the /serviceKey admin bypass, that the ADMIN_TOKEN environment variable is UNSET - which is the default state, so default-configured deployments are exploitable. The /helmValues exposure has no precondition at all because the route was registered without any auth middleware. What limits exploitation: the OpenCost API must be reachable by the attacker (typically in-cluster or via an exposed ingress/LoadBalancer rather than the public internet by default), the serviceKey-tampering impact depends on GCP being the configured cloud provider, and setting ADMIN_TOKEN in pre-patch versions closes the write-endpoint bypass but does NOT protect the unauthenticated /helmValues route.

The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N, base 8.7) confirms remote, low-complexity, unauthenticated exploitation with high confidentiality impact - corroborated by CWE-306, publicly available exploit code, and an available vendor patch. The vector rates only confidentiality (VC:H) and marks integrity none (VI:N), yet the description explicitly states attackers can modify GCP service account keys via POST /serviceKey, which is an integrity impact - the official vector appears to under-count the serviceKey tampering, so this analysis independently assesses integrity as High. There is no EPSS score in the input and the CVE is not listed in CISA KEV, so exploitation status is 'no public exploit identified as actively used' despite POC availability; do not conflate the public POC with in-the-wild use. Net: a genuine high priority for OpenCost operators because the default configuration (no ADMIN_TOKEN) is vulnerable and credential theft is the payoff, but real-world blast radius depends on how many deployments expose the OpenCost API beyond the cluster boundary.

An attacker who can reach the OpenCost HTTP API (for example a pod on the cluster network or via an over-exposed ingress) sends an unauthenticated GET /helmValues and receives the base64-decoded HELM_VALUES containing cloud provider credentials. Using the same lack of authentication, they POST /serviceKey to replace the GCP service account key, redirecting billing calls under their control. Publicly available exploit code exists, and the low attack complexity (AC:L, no user interaction) makes this trivial to weaponize.