CVE-2026-44300

OpenCost prior to 1.121.0 exposes a POST /serviceKey endpoint (pkg/costmodel/router.go) that calls AddServiceKey without mandatory authentication, letting any network client who can reach the service write an attacker-controlled key form value into the GCP service-account key. file at the location derived from GetGCPAuthSecretFilePath. The attacker controls the file contents but not the CONFIG_PATH-derived directory, the key. filename, or the file mode, so this is a credential-replacement flaw rather than arbitrary file write. Successful exploitation lets an attacker disrupt GCP cost collection (availability impact) or cause OpenCost to authenticate to GCP with attacker-selected credentials (integrity impact), reflected in the CVSS 4.0 score of 8.8 with high integrity and availability impact and no direct confidentiality impact. A wildcard Access-Control-Allow-Origin on responses also permits browser-assisted requests when the service is reachable from a victim's browser. The issue is fixed in OpenCost 1.121.0; there is no known public PoC, no confirmed exploitation in the wild, and it is not listed in CISA's KEV.

What to do: Upgrade OpenCost to version 1.121.0 or later as soon as possible. If immediate upgrade is not feasible, restrict network access to the OpenCost UI/API port so only trusted cluster-internal or VPN clients can reach it, and verify the contents of the GCP service-account key. file at the CONFIG_PATH location for signs of unauthorized replacement. Also rotate the GCP service-account credentials if tampering is suspected and review GCP audit logs for unexpected API activity under that identity.