Read the docs
TI-2026-36602 Aliases CVE-2026-49447GHSA-5fqm-cc34-fcf5

Cosmos-Server's constellation public-devices endpoint accepts arbitrary bearer tokens

Priority LOW 30CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-287.

Summary

Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. In 0.22.18, `GET /cosmos/api/constellation/public-devices` discloses Constellation device metadata to a requester that supplies any non-empty Authorization header. The handler strips the string Bearer from the header but never validates the resulting token and never uses it in the database query. This vulnerability is fixed in 0.22.19.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00384 32nd percentileScored 2026-11-07
Fix Fixed github.com/azukaar/cosmos-server (Go): 0.22.19

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
azukaarCosmos-Server0.22.18—No fix listedCNA
—github.com/azukaar/cosmos-server (Go)0.22.18 to before 0.22.190.22.19Patch availableGHSA-5fqm-cc34-fcf5
  • Cosmos-Server Vendorazukaar Affected 0.22.18 Fixed in — No fix listed CNA
  • github.com/azukaar/cosmos-server (Go) Vendor— Affected 0.22.18 to before 0.22.19 Fixed in 0.22.19 Patch available GHSA-5fqm-cc34-fcf5

Remediation

  • Fix · GHSA-5fqm-cc34-fcf5 github.com/azukaar/cosmos-server (Go) Fixed in 0.22.19 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-49447
  2. 2026-10-03 Alias added: GHSA-5fqm-cc34-fcf5

References

Other 4

  • TI-2026-36601 Cosmos: Authentication bypass via forward-auth header smuggling on Constellation tunnel in Cosmos-Server CVSS 3.1MEDIUM 6.1
  • TI-2025-16999 Cosmos userbase checking vulnerability CVSS 4.0MEDIUM 6.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences