Vulnerabilities

TI-2026-36601 CVE-2026-49446 · GHSA-2rx5-2g7j-2659

Cosmos: Authentication bypass via forward-auth header smuggling on Constellation tunnel in Cosmos-Server

MEDIUM 62

Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager.

CVSS 3.1MEDIUM 6.1 Adjacent network High privileges No interaction EPSS 0.00299 Published 2026-09-15 Fixed in 0.22.19 CWE-285

TI-2026-36602 CVE-2026-49447 · GHSA-5fqm-cc34-fcf5

LOW 30

Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00384 Published 2026-07-28 Fixed in 0.22.19 CWE-287

TI-2025-16999 CVE-2025-23214

LOW 37

Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00657 Published 2025-01-20 Fixed in 0.17.7 CWE-204