CVE-2026-42088 Details
Description
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to version 7.0.0-rc3, the Script Runner widget allows users to execute Python and Ruby scripts directly from the openc3-COSMOS-script-runner-api container. Because all the docker containers share a network, users can execute specially crafted scripts to bypass the API permissions check and perform administrative actions, including reading and modifying data inside the Redis database, which can be used to read secrets and change COSMOS settings, as well as read and write to the buckets service, which holds configuration, log, and plugin files. These actions are normally only available from the Admin Console or with administrative privileges. Any user with permission to create and run scripts can connect to any service in the docker network. This issue has been patched in version 7.0.0-rc3.
A vulnerability exists in OpenC3 COSMOS versions prior to 7.0.0-rc3, within the Script Runner widget of the openc3-COSMOS-script-runner-api container. This vulnerability allows users to execute Python and Ruby scripts that can bypass API permission checks and perform administrative tasks. Exploitation of this vulnerability enables unauthorized access to the Redis database, where sensitive information such as secrets and COSMOS configuration settings can be read or modified. Additionally, the vulnerability allows manipulation of the buckets service, which stores configuration, log, and plugin files. These administrative actions are typically restricted to the Admin Console or require elevated privileges. The vulnerability arises from the Script Runner's ability to execute scripts that exploit the shared network environment of the Docker containers, potentially leading to unauthorized access and modification of critical application data.
Users can update to OpenC3 COSMOS version 7.0.0-rc3 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/OpenC3/cosmos/security/advisories/GHSA-2wvh-87g2-89hr | CISA-ADP | ExploitVendor Advisory |
| https://github.com/OpenC3/cosmos/releases/tag/v7.0.0 | [email protected] | Release Notes |
| https://github.com/OpenC3/cosmos/releases/tag/v7.0.0-rc3 | [email protected] | Release Notes |
| https://github.com/OpenC3/cosmos/security/advisories/GHSA-2wvh-87g2-89hr | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-250 | Execution with Unnecessary Privileges | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| openc3 cosmos | < 7.0.0 7.0.0 rc1 7.0.0 rc2 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 13, 2026 | Initial Analysis | [email protected] |
| May 4, 2026 | CVE Modified | CISA-ADP |
| May 4, 2026 | New CVE Received | [email protected] |