CVE-2026-44300: OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection

July 14, 2026

OpenCost contains an unauthenticated file write vulnerability in the /serviceKey endpoint that allows remote attackers to overwrite the GCP service account key file without authentication. This can lead to service disruption, credential theft, and potential privilege escalation within Kubernetes clusters.

References

github.com/advisories/GHSA-wmj8-9953-vff5
github.com/opencost/opencost/security/advisories/GHSA-wmj8-9953-vff5
nvd.nist.gov/vuln/detail/CVE-2026-44300

Code Behaviors & Features

Detect and mitigate CVE-2026-44300 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →