HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-67349 — OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, expo...

·Source: NIST NVD

Updated:

Executive Summary

OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded HELM_VALUES environment variable containing cloud provider credentials. Additionally, adminAuthMiddleware fails open when ADMIN_TOKEN is unset, allowing unauthenticated attackers to modify GCP service account keys via POST /serviceKey to redirect billing calls.

Analysis

OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded HELM_VALUES environment variable containing cloud provider credentials. Additionally, adminAuthMiddleware fails open when ADMIN_TOKEN is unset, allowing unauthenticated attackers to modify GCP service account keys via POST /serviceKey to redirect billing calls. CVSS Score: 7.5. Published: 2026-07-30T15:16:36.900.

Indicators of Compromise (1)

CVE (1)
CVE-2026-67349
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jul 30, 2026. Verified by: NIST.

Related Threats

HIGHVulnerability

NVD HIGH: CVE-2026-9322 — IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Serv...

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 are vulnerable to a denial of service via a crafted HTTP request.

CVE-2026-9322
NIST NVD
HIGHVulnerability

NVD HIGH: CVE-2026-12945 — IBM Langflow OSS 1.0.0 through 1.10.1 allows authenticated users to access and m...

IBM Langflow OSS 1.0.0 through 1.10.1 allows authenticated users to access and manipulate other users' build jobs through improper access control on log retrieval and unauthenticated build endpoints.

CVE-2026-12945
NIST NVD
CRITICALVulnerability

NVD CRITICAL: CVE-2026-12940 — IBM Langflow OSS 1.0.0 through 1.10.1  are vulnerable to unauthenticated remote ...

IBM Langflow OSS 1.0.0 through 1.10.1  are vulnerable to unauthenticated remote code execution via environment variable injection in the MCP (Model Context Protocol) stdio launcher. The vulnerability exists in src/lfx/src/lfx/base/mcp/util.py where the DANGEROUS_ENV_VARS blocklist fails to include SHELLOPTS , BASHOPTS , and PS4 environment variables.

CVE-2026-12940
NIST NVD