EUVD-2026-51152
GHSA-fq2p-hx59-r7g8
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote unauthenticated access against default config (PR:N/AC:L); credential disclosure gives C:H and POST /serviceKey key tampering gives I:H, with no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded HELM_VALUES environment variable containing cloud provider credentials. Additionally, adminAuthMiddleware fails open when ADMIN_TOKEN is unset, allowing unauthenticated attackers to modify GCP service account keys via POST /serviceKey to redirect billing calls.
AnalysisAI
Credential disclosure and admin authentication bypass in OpenCost before 1.121.0 lets remote unauthenticated attackers read cloud provider secrets and tamper with billing configuration. The GET /helmValues endpoint ships with no authentication and returns the base64-decoded HELM_VALUES environment variable containing cloud credentials, while adminAuthMiddleware fails open when ADMIN_TOKEN is unset, allowing POST /serviceKey to overwrite GCP service account keys and redirect billing calls. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to the OpenCost cost-model API and, for the /serviceKey admin bypass, that the ADMIN_TOKEN environment variable is UNSET - which is the default state, so default-configured deployments are exploitable. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N, base 8.7) confirms remote, low-complexity, unauthenticated exploitation with high confidentiality impact - corroborated by CWE-306, publicly available exploit code, and an available vendor patch. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who can reach the OpenCost HTTP API (for example a pod on the cluster network or via an over-exposed ingress) sends an unauthenticated GET /helmValues and receives the base64-decoded HELM_VALUES containing cloud provider credentials. Using the same lack of authentication, they POST /serviceKey to replace the GCP service account key, redirecting billing calls under their control. … |
| Remediation | Vendor-released patch: upgrade to OpenCost core/v1.121.0 or later (https://github.com/opencost/opencost/releases/tag/core/v1.121.0), which adds adminAuthMiddleware to /helmValues and changes the middleware to fail closed - returning HTTP 503 with Cache-Control: no-store when ADMIN_TOKEN is unset (commit a49a25bc2e0d6e220a131a4dc58f38ebe6ae851b, PR https://github.com/opencost/opencost/pull/3910). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all OpenCost deployments and identify instances running versions below 1.121.0; review access logs for the /helmValues and /serviceKey endpoints. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today