Signal is active with 3 mentions in latest observed window
Immediate actions
Patch affected systems immediately
Recommended action window: Monitor and triage in normal cycle
NVD description
OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded HELM_VALUES environment variable containing cloud provider credentials. Additionally, adminAuthMiddleware fails open when ADMIN_TOKEN is unset, allowing unauthenticated attackers to modify GCP service account keys via POST /serviceKey to redirect billing calls.
CVE-2026-67349: OpenCost before 1.121.0 leaks cloud credentials via unauthenticated /helmValues and lets attackers redirect billing via /serviceKey when ADMIN_TOKEN is unset. Two vulns, one CVE. Here's what to check Friday.
Post summary
The post announces CVE-2026-67349, describing how OpenCost prior to v1.121.0 can leak cloud credentials through an unauthenticated /helmValues endpoint and allow billing redirection via /serviceKey when ADMIN_TOKEN is unset, with no mention of active exploitation or patch availability.
CVE-2026-67349 - Vulnerability Details - OpenCVE OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded HELM_VALUES environment variable containing cloud provider credentials. Additionally, adminAuthMiddleware fails open when ADMIN_TOKEN is unset, allowing unauthenticated attackers to modify GCP service account keys via POST /serviceKey to redirect billing calls.
If your organization uses OpenCost, take action now:
✅ Upgrade to OpenCost 1.121.0 or later
✅ Confirm ADMIN_TOKEN is properly configured
✅ Restrict access to sensitive endpoints
✅ Rotate any exposed cloud provider credentials
✅ Review billing, service account, and access logs for suspicious activity
Cloud cost visibility should never come at the expense of security. Vistem Solutions helps businesses strengthen cloud, identity, and cybersecurity controls before vulnerabilities become business disruptions.
📩 Need support securing your environment? Contact us at sales@vistem.com
#Cybersecurity#CVE#CloudSecurity#OpenCost#GCP#Kubernetes#VulnerabilityManagement#CyberResilience#BusinessSecurity#VistemSolutions#VistemElevate#SecureInnovation
https://app.opencve.io/cve/CVE-2026-67349?utm_source=in_page&utm_medium=Vistem+Solutions%2C+Inc.&utm_campaign=publer
Post summary
The advisory conveys that CVE-2026-67349 affects OpenCost’s authentication, provides technical details, and directs users to patch and configure the product to mitigate the risk.
Fixed in core/v1.121.0. Commit a49a25b. If you run OpenCost in prod and haven't patched, do it before Monday.
Source: https://nvd.nist.gov/vuln/detail/CVE-2026-67349
Post summary
The text announces that CVE‑2026‑67349 is fixed in core/v1.121.0 and urges users to patch before Monday.
