Read the docs
TI-2026-36601 Aliases CVE-2026-49446GHSA-2rx5-2g7j-2659

Cosmos: Authentication bypass via forward-auth header smuggling on Constellation tunnel in Cosmos-Server

Priority MEDIUM 62CWE-285Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-285.

Summary

Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Prior to 0.22.19, tokenMiddleware in src/proxy/routerGen.go can return through the Constellation tunnel bypass before removing x-cosmos-user, x-cosmos-role, x-cosmos-user-role, and x-cosmos-mfa headers and before invoking AdminOnlyWithRedirect. An attacker with a valid x-cstln-auth API key for an enrolled device who reaches Cosmos through the Constellation Nebula tunnel can supply a chosen x-cosmos-user value to a route with AuthEnabled enabled when the upstream application trusts that forward-auth header. The request can bypass Cosmos JWT, password, MFA, and AdminOnly checks, allowing user impersonation and admin-tier reads or writes exposed by the proxied application. This issue is fixed in version 0.22.19.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00299 22nd percentileScored 2026-11-07
Fix Fixed Cosmos-Server (azukaar): 0.22.19github.com/azukaar/cosmos-server (Go): 0.22.19

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
azukaarCosmos-Serverbefore 0.22.190.22.19Patch availableCNA
—github.com/azukaar/cosmos-server (Go)before 0.22.190.22.19Patch availableGHSA-2rx5-2g7j-2659
  • Cosmos-Server Vendorazukaar Affected before 0.22.19 Fixed in 0.22.19 Patch available CNA
  • github.com/azukaar/cosmos-server (Go) Vendor— Affected before 0.22.19 Fixed in 0.22.19 Patch available GHSA-2rx5-2g7j-2659

Remediation

  • Fix · CNA Cosmos-Server (azukaar) Fixed in 0.22.19
  • Fix · GHSA-2rx5-2g7j-2659 github.com/azukaar/cosmos-server (Go) Fixed in 0.22.19 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-49446
  2. 2026-10-03 Alias added: GHSA-2rx5-2g7j-2659
  3. 2026-11-06 Affected versions changed · Red Hat
  4. 2026-11-06 CVSS score added · Red Hat

References

Other 4

  • TI-2025-16999 Cosmos userbase checking vulnerability CVSS 4.0MEDIUM 6.9
  • TI-2026-36602 Cosmos-Server's constellation public-devices endpoint accepts arbitrary bearer tokens CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences