CVE-2026-44300
Summary
OpenCost contains an unauthenticated file write vulnerability in the /serviceKey endpoint that allows remote attackers to overwrite the GCP service account key file without authentication. This can lead to service disruption, credential theft, and potential privilege escalation within Kubernetes clusters.
Affected Versions
- OpenCost: All versions up to and including the latest release
- Vulnerable File: pkg/costmodel/router.go (lines 365-379)
- Vulnerable Endpoint: POST /serviceKey
Vulnerability Details
Root Cause
The AddServiceKey function in pkg/costmodel/router.go accepts user-supplied data via POST request and writes it directly to a file without any authentication or input validation:
func (a *Accesses) AddServiceKey(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {
w.Header().Set("Content-Type", "application/json")
w.Header().Set("Access-Control-Allow-Origin", "*") // Overly permissive CORS
r.ParseForm()
key := r.PostForm.Get("key") // User-controlled input, no validation
k := []byte(key)
err := os.WriteFile(env.GetGCPAuthSecretFilePath(), k, 0644) // Direct file write
if err != nil {
fmt.Fprintf(w, "Error writing service key: %s", err)
}
w.WriteHeader(http.StatusOK)
}
File Path Determination (core/pkg/env/core.go):
func GetGCPAuthSecretFilePath() string {
return GetPathFromConfig("key.json")
}
func GetPathFromConfig(fileName string) string {
return filepath.Join(GetConfigPath(), fileName)
}
func GetConfigPath() string {
return Get(ConfigPathEnvVar, DefaultConfigPath) // Default: /var/configs
}
Security Issues
1. No Authentication: Any network-accessible client can invoke the endpoint
2. No Input Validation: User input is not validated as a valid GCP service account key
3. Overly Permissive CORS: Access-Control-Allow-Origin: * allows cross-origin attacks
4. Predictable File Path: File location controlled by CONFIG_PATH environment variable
Proof of Concept
Environment Setup
Prerequisites
- Kubernetes cluster (tested on
⚡ Watch CVE-2026-44300
Get an email if CVE-2026-44300 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Advisory coverage (1)
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-44300)