← Vulnerability feed

Vulnerability record · CVE-2026-42088 · published 4 May 2026

CVE-2026-42088: Openc3 cosmos execution with unnecessary privileges vulnerability

OOpenc3 · Cosmos

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to version 7.0.0-rc3, the Script Runner widget allows users to execute Python and Ruby scripts directly from the openc3-COSMOS-script-runner-api container. Because all the docker containers share a network, users can execute specially crafted scripts to bypass the API permissions check and perform administrative actions, including reading and modifying data inside the Redis database, which can be used to read secrets and change COSMOS settings, as well as read and write to the buckets service, which holds configuration, log, and plugin files. These actions are normally only available from the Admin Console or with administrative privileges. Any user with permission to create and run scripts can connect to any service in the docker network. This issue has been patched in version 7.0.0-rc3.

8.1 CVSS 3.1 High EPSS 0.49% · top 60.2% CWE-250 · Execution with unnecessary privileges
8.1CVSS 3.1 base score
0.49%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to version 7.0.0-rc3, the Script Runner widget allows users to execute Python and Ruby scripts directly from the openc3-COSMOS-script-runner-api container. Because all the docker containers share a network, users can execute specially crafted scripts to bypass the API permissions check and perform administrative actions, including reading and modifying data inside the Redis database, which can be used to read secrets and change COSMOS settings, as well as read and write to the buckets service, which holds configuration, log, and plugin files. These actions are normally only available from the Admin Console or with administrative privileges. Any user with permission to create and run scripts can connect to any service in the docker network. This issue has been patched in version 7.0.0-rc3.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/OpenC3/cosmos/releases/tag/v7.0.0 Release Notes
https://github.com/OpenC3/cosmos/releases/tag/v7.0.0-rc3 Release Notes
https://github.com/OpenC3/cosmos/security/advisories/GHSA-2wvh-87g2-89hr ExploitVendor Advisory
https://github.com/OpenC3/cosmos/security/advisories/GHSA-2wvh-87g2-89hr ExploitVendor Advisory

Track CVE-2026-42088 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2025-28389Openc3 cosmos weak password requirements vulnerabilityWeak password requirements in OpenC3 COSMOS v6.0.0 allow attackers to bypass authentication via a brute force attack.EPSS 0.60%9.8CVE-2025-28386Openc3 cosmos code injection vulnerabilityA remote code execution (RCE) vulnerability in the Plugin Management component of OpenC3 COSMOS v6.0.0 allows attackers to execute arbitrary code via…EPSS 1.1%9.8CVE-2025-28388Openc3 cosmos hard-coded credentials vulnerabilityOpenC3 COSMOS before v6.0.2 was discovered to contain hardcoded credentials for the Service Account.EPSS 0.61%9.6CVE-2026-42087Openc3 cosmos sql injection vulnerabilityOpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From version 6.7.0 to before …EPSS 0.45%9.1CVE-2025-28384Openc3 cosmos path traversal vulnerabilityAn issue in the /script-api/scripts/ endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal.EPSS 0.89%8.1CVE-2026-42084Openc3 cosmos vulnerabilityOpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to versions 6.10.5 and …EPSS 0.44%7.5CVE-2025-28381Openc3 cosmos vulnerabilityA credential leak in OpenC3 COSMOS before v6.0.2 allows attackers to access service credentials as environment variables stored in all containers.EPSS 0.52%7.5CVE-2025-28382Openc3 cosmos path traversal vulnerabilityAn issue in the openc3-api/tables endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal.EPSS 0.89%

Source: NIST National Vulnerability Database (record CVE-2026-42088), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.