CVE-2026-44300

OpenCost provides cost monitoring for Kubernetes workloads and cloud costs. Prior to 1.121.0, the POST /serviceKey endpoint in pkg/costmodel/router.go allows a network client to invoke AddServiceKey without mandatory authentication and submit an arbitrary key form value that is written to the GCP service-account key.json file returned by GetGCPAuthSecretFilePath in core/pkg/env/core.go. The attacker controls the file contents but not the CONFIG_PATH-derived directory, the key.json filename, or the file mode. Replacing the credential contents can disrupt GCP cost collection or cause OpenCost to use attacker-selected credentials, and the wildcard Access-Control-Allow-Origin response permits browser-assisted requests when the service is reachable from a browser. This issue is fixed in version 1.121.0.

• CWE-20
• CWE-309

• https://github.com/opencost/opencost/commit/69430e7f627b3e62c8999312c06949267fab813a
• https://github.com/opencost/opencost/commit/a49a25bc2e0d6e220a131a4dc58f38ebe6ae851b
• https://github.com/opencost/opencost/pull/3651
• https://github.com/opencost/opencost/pull/3910
• https://github.com/opencost/opencost/releases/tag/v1.120.0
• https://github.com/opencost/opencost/releases/tag/v1.121.0
• https://github.com/opencost/opencost/security/advisories/GHSA-wmj8-9953-vff5

Published

Sep 15, 2026

Last Modified

Sep 15, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-44293protobufjs compiles protobuf definitions into JavaScript (JS…8.8
• CVE-2026-44294protobufjs compiles protobuf definitions into JavaScript (JS…5.3
• CVE-2026-44295protobufjs-cli is the command line add-on for protobuf.js. P…8.7
• CVE-2026-44296Deskflow is a keyboard and mouse sharing app. Prior to 1.26.…7.5
• CVE-2026-44298Kimai is an open-source time tracking application. From vers…4.9
• CVE-2026-4430Out-of-bounds write vulnerability in The Document Foundation…7.8
• CVE-2026-44301Hugo is a static site generator. From 0.43 to before 0.161.0…8.1
• CVE-2026-44302Snappier is a high performance C# implementation of the Snap…7.5
• CVE-2026-44304Lemur manages TLS certificate creation. Prior to 1.9.0, Lemu…8.1
• CVE-2026-44305Lemur manages TLS certificate creation. Prior to 1.9.0, when…6.8
• CVE-2026-44306Statamic is a Laravel and Git powered content management sys…5.3
• CVE-2026-44307Mako is a template library written in Python. Prior to 1.3.1…8.7