{"id":"EUVD-2026-78874","enisaUuid":"9bac74e2-0628-31c6-8b97-5ec945e50181","description":"OpenCost provides cost monitoring for Kubernetes workloads and cloud costs. Prior to 1.121.0, the POST /serviceKey endpoint in pkg/costmodel/router.go allows a network client to invoke AddServiceKey without mandatory authentication and submit an arbitrary key form value that is written to the GCP service-account key.json file returned by GetGCPAuthSecretFilePath in core/pkg/env/core.go. The attacker controls the file contents but not the CONFIG_PATH-derived directory, the key.json filename, or the file mode. Replacing the credential contents can disrupt GCP cost collection or cause OpenCost to use attacker-selected credentials, and the wildcard Access-Control-Allow-Origin response permits browser-assisted requests when the service is reachable from a browser. This issue is fixed in version 1.121.0.","datePublished":"Sep 15, 2026, 5:08:15 PM","dateUpdated":"Sep 15, 2026, 7:45:01 PM","baseScore":8.8,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/opencost/opencost/security/advisories/GHSA-wmj8-9953-vff5\nhttps://github.com/opencost/opencost/pull/3651\nhttps://github.com/opencost/opencost/pull/3910\nhttps://github.com/opencost/opencost/commit/69430e7f627b3e62c8999312c06949267fab813a\nhttps://github.com/opencost/opencost/commit/a49a25bc2e0d6e220a131a4dc58f38ebe6ae851b\nhttps://github.com/opencost/opencost/releases/tag/v1.120.0\nhttps://github.com/opencost/opencost/releases/tag/v1.121.0\n","aliases":"CVE-2026-44300\nGHSA-wmj8-9953-vff5\n","assigner":"GitHub_M","epss":0.75,"enisaIdProduct":[{"id":"9d76d9e4-5735-35f1-8a8d-48350f1d3b7b","product":{"name":"opencost","vendor":{"name":"opencost"}},"product_version":"\u003c 1.121.0"}],"enisaIdVendor":[{"id":"9272f54d-bc96-32f6-bbaf-8a78dc9d5c3a","vendor":{"name":"opencost"}}],"enisaIdVulnerability":[{"id":"e5a7488a-7feb-33de-abab-09a9ff3d5f8f","vulnerability":{"id":"CVE-2026-44300","description":"OpenCost provides cost monitoring for Kubernetes workloads and cloud costs. Prior to 1.121.0, the POST /serviceKey endpoint in pkg/costmodel/router.go allows a network client to invoke AddServiceKey without mandatory authentication and submit an arbitrary key form value that is written to the GCP service-account key.json file returned by GetGCPAuthSecretFilePath in core/pkg/env/core.go. The attacker controls the file contents but not the CONFIG_PATH-derived directory, the key.json filename, or the file mode. Replacing the credential contents can disrupt GCP cost collection or cause OpenCost to use attacker-selected credentials, and the wildcard Access-Control-Allow-Origin response permits browser-assisted requests when the service is reachable from a browser. This issue is fixed in version 1.121.0.","datePublished":"Sep 15, 2026, 5:08:15 PM","dateUpdated":"Sep 15, 2026, 7:45:01 PM","status":"PUBLISHED","baseScore":8.8,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/opencost/opencost/security/advisories/GHSA-wmj8-9953-vff5\nhttps://github.com/opencost/opencost/pull/3651\nhttps://github.com/opencost/opencost/pull/3910\nhttps://github.com/opencost/opencost/commit/69430e7f627b3e62c8999312c06949267fab813a\nhttps://github.com/opencost/opencost/commit/a49a25bc2e0d6e220a131a4dc58f38ebe6ae851b\nhttps://github.com/opencost/opencost/releases/tag/v1.120.0\nhttps://github.com/opencost/opencost/releases/tag/v1.121.0\n","enisa_id":"EUVD-2026-78874\n","assigner":"GitHub_M","epss":0.75,"dataProcessed":"Nov 7, 2026, 7:21:46 AM","vulnerabilityProduct":[{"id":"0882d4c2-25cf-3d74-bde1-37660e09fe9b","product":{"name":"opencost","vendor":{"name":"opencost"}},"product_version":"\u003c 1.121.0"}],"vulnerabilityVendor":[{"id":"2078b424-e4fb-311c-bd36-6c902422d982","vendor":{"name":"opencost"}}]}},{"id":"ec3db3fa-470c-34ad-9ff4-c623a77d2c9c","vulnerability":{"id":"GHSA-wmj8-9953-vff5","description":"OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection","datePublished":"Jul 14, 2026, 5:07:53 PM","dateUpdated":"Jul 14, 2026, 5:19:44 PM","baseScore":0.0,"references":"https://github.com/opencost/opencost/security/advisories/GHSA-wmj8-9953-vff5\nhttps://github.com/opencost/opencost\n","enisa_id":"EUVD-2026-78874\n","aliases":"GHSA-wmj8-9953-vff5\nCVE-2026-44300\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:02:28 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}