CyberRota Analysis
AI-GeneratedThe OpenCost component in Kubernetes versions prior to 1.121.0 is vulnerable due to a lack of mandatory authentication on the POST /serviceKey endpoint, allowing attackers to submit arbitrary key values that can overwrite the GCP service-account key.json file. This could lead to unauthorized access to GCP resources, disrupt cost collection, or enable the use of attacker-controlled credentials. Organizations using OpenCost for Kubernetes workload monitoring should prioritize upgrading to version 1.121.0 to mitigate this high-severity vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
OpenCost provides cost monitoring for Kubernetes workloads and cloud costs. Prior to 1.121.0, the POST /serviceKey endpoint in pkg/costmodel/router.go allows a network client to invoke AddServiceKey without mandatory authentication and submit an arbitrary key form value that is written to the GCP service-account key.json file returned by GetGCPAuthSecretFilePath in core/pkg/env/core.go. The attacker controls the file contents but not the CONFIG_PATH-derived directory, the key.json filename, or the file mode. Replacing the credential contents can disrupt GCP cost collection or cause OpenCost to use attacker-selected credentials, and the wildcard Access-Control-Allow-Origin response permits browser-assisted requests when the service is reachable from a browser. This issue is fixed in version 1.121.0.