{"items":[{"id":"NVI-00017530","kind":"vulnerability","title":"OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-wmj8-9953-vff5","CVE-2026-44300"],"plain_summary":"GitHub lists this reviewed advisory for github.com/opencost/opencost. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-14ebac901d32855e64fc04f3970fe47b"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-14ebac901d32855e64fc04f3970fe47b","url":"https://github.com/advisories/GHSA-wmj8-9953-vff5","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-wmj8-9953-vff5","publisher":"GitHub Advisory Database","observed_at":"2026-11-04T23:34:12.429Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-14ebac901d32855e64fc04f3970fe47b"],"technology":"github.com/opencost/opencost","known_exclusions":[],"conditions_summary":"## Summary\n\nOpenCost contains an unauthenticated  file write vulnerability in the `/serviceKey` endpoint that allows remote attackers to overwrite the GCP service account key file without authentication. This can lead to service disruption, credential theft, and potential privilege escalation within Kubernetes clusters.\n\n---\n\n\n## Affected Versions\n\n- **OpenCost**: All versions up to and including the latest release\n- **Vulnerable File**: `pkg/costmodel/router.go` (lines 365-379)\n- **Vulnerable Endpoint**: `POST /serviceKey`\n\n---\n\n## Vulnerability Details\n\n### Root Cause\n\nThe `AddServiceKey` function in `pkg/costmodel/router.go` accepts user-supplied data via POST request and writes it directly to a file without any authentication or input validation:\n\n```go\nfunc (a *Accesses) AddServiceKey(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {\n    w.Header().Set(\"Content-Type\", \"application/json\")\n    w.Header().Set(\"Access-Control-Allow-Origin\", \"*\")  // Overly permissive CORS\n\n    r.ParseForm()\n\n    key := r.PostForm.Get(\"key\")  // User-controlled input, no validation\n    k := []byte(key)\n    err := os.WriteFile(env.GetGCPAuthSecretFilePath(), k, 0644)  //  Direct file w","public_affected_ranges":["< 1.119.1"]}],"null_published_at":"2026-11-05T19:10:21.405Z","source_updated_at":"2026-07-14T17:19:45.000Z","source_disclosed_at":"2026-07-14T17:07:53.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-04T23:34:12.429Z"}],"next_cursor":null,"snapshot_revision":"42594"}