CVE-2026-44300: OpenCost Authentication Bypass Vulnerability

CVE-2026-44300 Overview

OpenCost, a Kubernetes cost monitoring project, contains an unauthenticated write vulnerability in versions prior to 1.121.0. The POST /serviceKey endpoint in pkg/costmodel/router.go invokes AddServiceKey without requiring authentication. A network-reachable attacker can submit an arbitrary key form value that OpenCost writes to the Google Cloud Platform (GCP) service-account key.json file returned by GetGCPAuthSecretFilePath in core/pkg/env/core.go. The wildcard Access-Control-Allow-Origin response header also enables browser-assisted requests when the service is reachable from a browser. This issue is categorized as improper input validation [CWE-20] and is fixed in version 1.121.0.

Critical Impact

Unauthenticated network attackers can overwrite the GCP service-account credential file used by OpenCost, disrupting cost collection or forcing OpenCost to authenticate with attacker-selected credentials.

Affected Products

• OpenCost versions prior to 1.121.0
• Kubernetes deployments exposing the OpenCost API to networks or browsers
• Environments using OpenCost with GCP service-account authentication

Discovery Timeline

• 2026-09-15 - CVE-2026-44300 published to NVD
• 2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-44300

Vulnerability Analysis

The flaw resides in the OpenCost HTTP router. The POST /serviceKey handler exposes AddServiceKey to any network client without authentication. OpenCost writes the submitted key form value directly to disk at the path returned by GetGCPAuthSecretFilePath. The attacker controls the file contents but not the CONFIG_PATH-derived directory, the key.json filename, or file permissions.

An attacker who overwrites this file can disrupt legitimate GCP cost collection. Alternatively, the attacker can plant credentials they control, causing OpenCost to authenticate against an attacker-owned GCP context. The wildcard Access-Control-Allow-Origin header widens the attack surface by permitting cross-origin browser requests when the service is reachable from a user's browser.

Root Cause

The root cause is missing authentication on a state-changing administrative endpoint combined with a permissive CORS policy. The router accepted write operations without enforcing an admin credential check, and no server-side validation constrained who could supply GCP credential material.

Attack Vector

Exploitation requires network reachability to the OpenCost service. The attacker sends an HTTP POST to /serviceKey with an arbitrary key form value. In browser-reachable deployments, a malicious page can trigger the same request cross-origin due to the wildcard CORS header.

// Security patch in pkg/costmodel/router.go — deactivate endpoints unless
// admin token set (Pull Request #3910)
// adminAuthMiddleware wraps a handler and requires a Bearer token matching ADMIN_TOKEN.
// When ADMIN_TOKEN is not set, returns 503 with Cache-Control: no-store — the endpoint is
// disabled until configured. When ADMIN_TOKEN is set, returns 401 if the Bearer token is
// missing or 403 if it does not match.
func adminAuthMiddleware(next httprouter.Handle) httprouter.Handle {
    return func(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {
        adminToken := env.GetAdminToken()
        if adminToken == "" {
            w.Header().Set("Cache-Control", "no-store")
            http.Error(w, "Admin token is required to activate this endpoint; set the ADMIN_TOKEN environment variable", http.StatusServiceUnavailable)
            return
        }
        authHeader := r.Header.Get("Authorization")
        // ... bearer token comparison using crypto/subtle
    }
}

Source: OpenCost Commit a49a25b

Detection Methods for CVE-2026-44300

Indicators of Compromise

• Unexpected POST requests to the /serviceKey endpoint from unknown source addresses
• Modification timestamps on key.json in the CONFIG_PATH directory that do not correlate with legitimate deployment activity
• OpenCost logs showing successful AddServiceKey invocations from external clients
• GCP audit logs showing authentication from unfamiliar service-account principals following an OpenCost interaction

Detection Strategies

• Inventory Kubernetes clusters running OpenCost and identify versions below 1.121.0
• Alert on HTTP POST traffic to /serviceKey originating from outside the trusted management plane
• Monitor filesystem integrity for the GCP key.json path returned by GetGCPAuthSecretFilePath
• Correlate GCP IAM authentication anomalies with recent OpenCost API activity

Monitoring Recommendations

• Enable HTTP access logging on the OpenCost service and forward logs to a centralized analytics platform
• Track cost-collection failures or gaps in GCP billing data as a possible sign of credential replacement
• Watch for cross-origin browser requests to OpenCost from unexpected referrers

How to Mitigate CVE-2026-44300

Immediate Actions Required

• Upgrade OpenCost to version 1.121.0 or later without delay
• Configure the new ADMIN_TOKEN environment variable so administrative write endpoints are activated only with a valid Bearer token
• Restrict network exposure of the OpenCost service to trusted management networks and authenticated ingress
• Rotate any GCP service-account credentials that may have been overwritten by an untrusted party

Patch Information

The fix is available in OpenCost Release v1.121.0. Two patches address the issue: Pull Request #3651 introduces adminAuthMiddleware with crypto/subtle Bearer-token comparison, and Pull Request #3910 hardens the middleware to return 503 Service Unavailable when ADMIN_TOKEN is unset, disabling admin endpoints by default. Additional context is available in the OpenCost Security Advisory GHSA-wmj8-9953-vff5.

Workarounds

• Place OpenCost behind an authenticating reverse proxy that blocks unauthenticated POST /serviceKey requests
• Apply Kubernetes NetworkPolicy rules to restrict ingress to the OpenCost pod to a small allowlist of clients
• Remove or override the wildcard Access-Control-Allow-Origin response header at the ingress layer to prevent browser-assisted exploitation

# Configuration example — set ADMIN_TOKEN so write endpoints activate with Bearer auth
kubectl -n opencost create secret generic opencost-admin \
  --from-literal=ADMIN_TOKEN="$(openssl rand -hex 32)"

kubectl -n opencost set env deployment/opencost \
  ADMIN_TOKEN="$(kubectl -n opencost get secret opencost-admin -o jsonpath='{.data.ADMIN_TOKEN}' | base64 -d)"