Opencost
Monthly
Credential disclosure and admin authentication bypass in OpenCost before 1.121.0 lets remote unauthenticated attackers read cloud provider secrets and tamper with billing configuration. The GET /helmValues endpoint ships with no authentication and returns the base64-decoded HELM_VALUES environment variable containing cloud credentials, while adminAuthMiddleware fails open when ADMIN_TOKEN is unset, allowing POST /serviceKey to overwrite GCP service account keys and redirect billing calls. Publicly available exploit code exists and a vendor patch (v1.121.0) is released; no public active-exploitation record (not in CISA KEV) at time of analysis.
Credential disclosure and admin authentication bypass in OpenCost before 1.121.0 lets remote unauthenticated attackers read cloud provider secrets and tamper with billing configuration. The GET /helmValues endpoint ships with no authentication and returns the base64-decoded HELM_VALUES environment variable containing cloud credentials, while adminAuthMiddleware fails open when ADMIN_TOKEN is unset, allowing POST /serviceKey to overwrite GCP service account keys and redirect billing calls. Publicly available exploit code exists and a vendor patch (v1.121.0) is released; no public active-exploitation record (not in CISA KEV) at time of analysis.