Vulnerability in OpenC3 COSMOS Allows Unauthorized Administrative Actions

CVE-2026-42088

What is CVE-2026-42088?

The OpenC3 COSMOS application, which facilitates command execution and data exchange with embedded systems, contains a vulnerability in the Script Runner widget prior to version 7.0.0-rc3. This issue allows users with script execution permissions to run malicious Python and Ruby scripts within the openc3-COSMOS-script-runner-api container. Due to the shared Docker network, these scripts can bypass API permission checks, granting unauthorized access to sensitive operations typically restricted to Admin Console users. Consequently, this could lead to unauthorized data manipulation within the Redis database, including retrieving confidential secrets and altering COSMOS configurations. Affected users should upgrade to version 7.0.0-rc3 to mitigate these risks.

References