Read the docs
TI-2026-30456 Aliases CVE-2026-42088

OpenC3 COSMOS: Administrative Actions via the Script Runner Tool

Priority HIGH 76CWE-250Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-250.

Summary

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to version 7.0.0-rc3, the Script Runner widget allows users to execute Python and Ruby scripts directly from the openc3-COSMOS-script-runner-api container. Because all the docker containers share a network, users can execute specially crafted scripts to bypass the API permissions check and perform administrative actions, including reading and modifying data inside the Redis database, which can be used to read secrets and change COSMOS settings, as well as read and write to the buckets service, which holds configuration, log, and plugin files. These actions are normally only available from the Admin Console or with administrative privileges. Any user with permission to create and run scripts can connect to any service in the docker network. This issue has been patched in version 7.0.0-rc3.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00341 27th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed cosmos (OpenC3): 7.0.0-rc3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OpenC3cosmosbefore 7.0.0-rc37.0.0-rc3Patch availableCNA
  • cosmos VendorOpenC3 Affected before 7.0.0-rc3 Fixed in 7.0.0-rc3 Patch available CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:openc3:cosmos:*:*:*:*:open_source:*:*:*before 7.0.0VulnerableOpenC3
cpe:2.3:a:openc3:cosmos:7.0.0:rc1:*:*:open_source:*:*:*7.0.0 rc1VulnerableOpenC3
cpe:2.3:a:openc3:cosmos:7.0.0:rc2:*:*:open_source:*:*:*7.0.0 rc2VulnerableOpenC3
  • cpe:2.3:a:openc3:cosmos:*:*:*:*:open_source:*:*:* Versions before 7.0.0 Vulnerable ·OpenC3
  • cpe:2.3:a:openc3:cosmos:7.0.0:rc1:*:*:open_source:*:*:* Versions 7.0.0 rc1 Vulnerable ·OpenC3
  • cpe:2.3:a:openc3:cosmos:7.0.0:rc2:*:*:open_source:*:*:* Versions 7.0.0 rc2 Vulnerable ·OpenC3

Remediation

  • Fix · CNA cosmos (OpenC3) Fixed in 7.0.0-rc3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-42088

References

Exploit 1

Other 2

  • TI-2025-20781 Weak password requirements in OpenC3 COSMOS v6.0.0 allow attackers to bypass authentication via a brute force attack. CVSS 3.1CRITICAL 9.8
  • TI-2025-20780 OpenC3 COSMOS before v6.0.2 was discovered to contain hardcoded credentials for the Service Account. CVSS 3.1CRITICAL 9.8
  • TI-2025-20779 A remote code execution (RCE) vulnerability in the Plugin Management component of OpenC3… CVSS 3.1CRITICAL 9.8
  • TI-2025-20778 An issue in the /script-api/scripts/ endpoint of OpenC3 COSMOS before 6.1.0 allows… CVSS 3.1CRITICAL 9.1
  • TI-2026-30455 OpenC3 COSMOS: SQL Injection in QuestDB Time-Series Data Base CVSS 3.1CRITICAL 9.6
  • TI-2025-20777 An issue in the openc3-api/tables endpoint of OpenC3 COSMOS before 6.1.0 allows attackers… CVSS 3.1HIGH 7.5
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences