Most recent entries from all https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 09:45:10 +0000 CVE-2026-67349 — OpenCost < 1.121.0 Unauthenticated Helm Values Exposure and Admin Bypass https://vulnerability.circl.lu/vuln/cve-2026-67349 <p><strong>Affected:</strong> opencost</p> <p>OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded HELM_VALUES environment variable containing cloud provider credentials. Additionally, adminAuthMiddleware fails open when ADMIN_TOKEN is unset, allowing unauthenticated attackers to modify GCP service account keys via POST /serviceKey to redirect billing calls.</p> <p><strong>Affected:</strong> opencost</p> <p>OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded HELM_VALUES environment variable containing cloud provider credentials. Additionally, adminAuthMiddleware fails open when ADMIN_TOKEN is unset, allowing unauthenticated attackers to modify GCP service account keys via POST /serviceKey to redirect billing calls.</p> https://vulnerability.circl.lu/vuln/cve-2026-67349