Summary
OpenCost exposes sensitive cloud provider credentials and administrative operations through unauthenticated API endpoints when certain environment variables are misconfigured or unset.
An attacker who can reach the OpenCost service can read HELM values and modify GCP service account keys, potentially redirecting billing and abusing cloud resources.
OpenCost exposes sensitive cloud provider credentials and administrative operations through unauthenticated API endpoints when certain environment variables are misconfigured or unset.
An attacker who can reach the OpenCost service can read HELM values and modify GCP service account keys, potentially redirecting billing and abusing cloud resources.
Affected context
This vulnerability occurs in OpenCost deployments running versions prior to 1.121.0 where:
- The
/helmValuesendpoint is reachable from untrusted networks or shared cluster contexts - The HELM_VALUES environment variable holds cloud provider credentials or other sensitive configuration
- The ADMIN_TOKEN environment variable is unset or misconfigured, causing
adminAuthMiddlewareto treat requests as authenticated by default
These conditions are more likely in test, shared, or loosely controlled Kubernetes environments, but can also arise in production clusters if network boundaries and environment variable configuration are not strictly enforced.
This vulnerability occurs in OpenCost deployments running versions prior to 1.121.0 where:
- The
/helmValuesendpoint is reachable from untrusted networks or shared cluster contexts - The HELM_VALUES environment variable holds cloud provider credentials or other sensitive configuration
- The ADMIN_TOKEN environment variable is unset or misconfigured, causing
adminAuthMiddlewareto treat requests as authenticated by default
These conditions are more likely in test, shared, or loosely controlled Kubernetes environments, but can also arise in production clusters if network boundaries and environment variable configuration are not strictly enforced.
Exploit preconditions
- Attack surface: HTTP API endpoints exposed by the OpenCost service (
/helmValues,/serviceKey) - Required access: Network access to the OpenCost instance (e.g., within the cluster, via ingress, or through port-forwarding/proxy)
- Trigger points:
- Issuing GET requests to
/helmValuesto retrieve base64-decoded HELM_VALUES contents - Sending POST requests to
/serviceKeyto update GCP service account keys and influence billing behavior - Why exploitation is possible: Authentication checks are missing or fail open:
/helmValuesis not protected by authentication, exposing environment-derived configurationadminAuthMiddlewaretreats lack ofADMIN_TOKENas success, allowing any caller to invoke privileged billing-related operations
- Attack surface: HTTP API endpoints exposed by the OpenCost service (
/helmValues,/serviceKey) - Required access: Network access to the OpenCost instance (e.g., within the cluster, via ingress, or through port-forwarding/proxy)
- Trigger points:
- Issuing GET requests to
/helmValuesto retrieve base64-decoded HELM_VALUES contents - Sending POST requests to
/serviceKeyto update GCP service account keys and influence billing behavior - Why exploitation is possible: Authentication checks are missing or fail open:
/helmValuesis not protected by authentication, exposing environment-derived configurationadminAuthMiddlewaretreats lack ofADMIN_TOKENas success, allowing any caller to invoke privileged billing-related operations
Why this happens
The core issue is improper enforcement of authentication on sensitive administrative endpoints, aligning with CWE-306: Missing Authentication for Critical Function.
In the /helmValues handler, access control is absent despite returning configuration derived from HELM_VALUES, which can include credentials.
In the admin middleware, the logic is implemented as "fail open" when the ADMIN_TOKEN configuration is missing, effectively disabling authentication checks for privileged actions.
This combination of unprotected read endpoints and misconfigured admin gating creates an insecure pattern where critical operations and secrets are exposed based solely on network reachability rather than explicit authorization.
The core issue is improper enforcement of authentication on sensitive administrative endpoints, aligning with CWE-306: Missing Authentication for Critical Function.
In the /helmValues handler, access control is absent despite returning configuration derived from HELM_VALUES, which can include credentials.
In the admin middleware, the logic is implemented as "fail open" when the ADMIN_TOKEN configuration is missing, effectively disabling authentication checks for privileged actions.
This combination of unprotected read endpoints and misconfigured admin gating creates an insecure pattern where critical operations and secrets are exposed based solely on network reachability rather than explicit authorization.
Potential impact
- Attackers may read HELM_VALUES containing cloud provider credentials or other sensitive configuration data.
- Adversaries could modify GCP service account keys via
/serviceKey, redirecting billing calls or misattributing costs. - Cloud resource abuse can occur, including spinning up infrastructure on compromised accounts and masking true usage attribution.
- Unauthorized changes to cost tracking and billing data can degrade financial visibility and incident response.
- Attackers may pivot from exposed credentials to broader cloud account compromise and lateral movement across services.
- Attackers may read HELM_VALUES containing cloud provider credentials or other sensitive configuration data.
- Adversaries could modify GCP service account keys via
/serviceKey, redirecting billing calls or misattributing costs. - Cloud resource abuse can occur, including spinning up infrastructure on compromised accounts and masking true usage attribution.
- Unauthorized changes to cost tracking and billing data can degrade financial visibility and incident response.
- Attackers may pivot from exposed credentials to broader cloud account compromise and lateral movement across services.
General mitigation guidance
Effective mitigation focuses on enforcing strict authentication and hardening configuration exposure patterns:
- Treat administrative and configuration endpoints as privileged surfaces and gate them behind robust authentication and authorization layers.
- Avoid fail-open behavior in middleware; design authentication checks to fail closed when configuration (such as tokens) is missing or invalid.
- Minimize sensitive data in environment variables and in API responses; where credentials must exist, segregate them from endpoints intended for inspection or debugging.
- Restrict network exposure of cost-monitoring and billing services to trusted networks or service meshes, using ingress controls and mTLS where applicable.
- Apply least privilege to any service accounts used by cost tooling, limiting the blast radius if credentials are inadvertently exposed.
Effective mitigation focuses on enforcing strict authentication and hardening configuration exposure patterns:
- Treat administrative and configuration endpoints as privileged surfaces and gate them behind robust authentication and authorization layers.
- Avoid fail-open behavior in middleware; design authentication checks to fail closed when configuration (such as tokens) is missing or invalid.
- Minimize sensitive data in environment variables and in API responses; where credentials must exist, segregate them from endpoints intended for inspection or debugging.
- Restrict network exposure of cost-monitoring and billing services to trusted networks or service meshes, using ingress controls and mTLS where applicable.
- Apply least privilege to any service accounts used by cost tooling, limiting the blast radius if credentials are inadvertently exposed.
How teams detect issues like this
Detection generally combines configuration audit, API behavior review, and automated checks:
- Perform code review to identify endpoints lacking authentication middleware, especially those touching environment variables or administrative operations.
- Use static analysis or policy-as-code (e.g., custom linters, Open Policy Agent) to flag handlers that bypass or misconfigure authentication checks and fail-open logic.
- Monitor access logs for unexpected unauthenticated requests to
/helmValues,/serviceKey, and similar endpoints, correlating with suspicious IP ranges or unusual request patterns. - Assess Kubernetes ingress, service, and service mesh configurations to identify where OpenCost APIs are externally reachable and verify that appropriate authentication layers are in place.
- Incorporate automated security testing (DAST/API fuzzing) into CI/CD pipelines to discover unauthenticated or weakly protected administrative endpoints before deployment.
Detection generally combines configuration audit, API behavior review, and automated checks:
- Perform code review to identify endpoints lacking authentication middleware, especially those touching environment variables or administrative operations.
- Use static analysis or policy-as-code (e.g., custom linters, Open Policy Agent) to flag handlers that bypass or misconfigure authentication checks and fail-open logic.
- Monitor access logs for unexpected unauthenticated requests to
/helmValues,/serviceKey, and similar endpoints, correlating with suspicious IP ranges or unusual request patterns. - Assess Kubernetes ingress, service, and service mesh configurations to identify where OpenCost APIs are externally reachable and verify that appropriate authentication layers are in place.
- Incorporate automated security testing (DAST/API fuzzing) into CI/CD pipelines to discover unauthenticated or weakly protected administrative endpoints before deployment.
