opencost

Records2All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high2CVSS 7.0–8.9

Exploited now

opencost records in CISA KEV

No opencost vulnerabilities are listed in CISA KEV.

Records

2 records

TI-2026-47645 CVE-2026-67349 · GHSA-fq2p-hx59-r7g8

OpenCost < 1.121.0 Unauthenticated Helm Values Exposure and Admin Bypass

HIGH 77

OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded HELM_VALUES environment variable containing cloud provider credentials.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00497 Published 2026-07-30 Fixed in 1.121.0 CWE-306

TI-2026-32269 CVE-2026-44300 · GHSA-wmj8-9953-vff5

OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection

MEDIUM 47

OpenCost provides cost monitoring for Kubernetes workloads and cloud costs.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00753 Published 2026-09-15 Fixed in 1.121.0, 1.119.1 CWE-20

Open these records in search →

Critical	0
High	2
Medium	0
Low	0
No CVSS	0