← Vulnerability feed

Vulnerability record · CVE-2026-42087 · published 4 May 2026

CVE-2026-42087: Openc3 cosmos sql injection vulnerability

OOpenc3 · Cosmos

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From version 6.7.0 to before version 7.0.0-rc3, a SQL injection vulnerability exists in the Time-Series Database (TSDB) component of COSMOS. The tsdb_lookup function in the cvt_model.rb file directly places user-supplied input into a SQL query without sanitizing the input. As a result, a user can break out of the initial SQL statement and execute arbitrary SQL commands, including deleting data. This issue has been patched in version 7.0.0-rc3.

9.6 CVSS 3.1 Critical EPSS 0.45% · top 63.8% CWE-89 · SQL injection
9.6CVSS 3.1 base score
0.45%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From version 6.7.0 to before version 7.0.0-rc3, a SQL injection vulnerability exists in the Time-Series Database (TSDB) component of COSMOS. The tsdb_lookup function in the cvt_model.rb file directly places user-supplied input into a SQL query without sanitizing the input. As a result, a user can break out of the initial SQL statement and execute arbitrary SQL commands, including deleting data. This issue has been patched in version 7.0.0-rc3.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/OpenC3/cosmos/commit/9ba60c09c8836a37a2e4ea67ab35fe403e041415 Patch
https://github.com/OpenC3/cosmos/releases/tag/v7.0.0-rc3 Release Notes
https://github.com/OpenC3/cosmos/security/advisories/GHSA-v529-vhwc-wfc5 ExploitVendor Advisory
https://github.com/OpenC3/cosmos/security/advisories/GHSA-v529-vhwc-wfc5 ExploitVendor Advisory

Track CVE-2026-42087 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2025-28389Openc3 cosmos weak password requirements vulnerabilityWeak password requirements in OpenC3 COSMOS v6.0.0 allow attackers to bypass authentication via a brute force attack.EPSS 0.60%9.8CVE-2025-28386Openc3 cosmos code injection vulnerabilityA remote code execution (RCE) vulnerability in the Plugin Management component of OpenC3 COSMOS v6.0.0 allows attackers to execute arbitrary code via…EPSS 1.1%9.8CVE-2025-28388Openc3 cosmos hard-coded credentials vulnerabilityOpenC3 COSMOS before v6.0.2 was discovered to contain hardcoded credentials for the Service Account.EPSS 0.61%9.1CVE-2025-28384Openc3 cosmos path traversal vulnerabilityAn issue in the /script-api/scripts/ endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal.EPSS 0.89%8.1CVE-2026-42088Openc3 cosmos execution with unnecessary privileges vulnerabilityOpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to version 7.0.0-rc3, t…EPSS 0.49%8.1CVE-2026-42084Openc3 cosmos vulnerabilityOpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to versions 6.10.5 and …EPSS 0.44%7.5CVE-2025-28381Openc3 cosmos vulnerabilityA credential leak in OpenC3 COSMOS before v6.0.2 allows attackers to access service credentials as environment variables stored in all containers.EPSS 0.52%7.5CVE-2025-28382Openc3 cosmos path traversal vulnerabilityAn issue in the openc3-api/tables endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal.EPSS 0.89%

Source: NIST National Vulnerability Database (record CVE-2026-42087), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.