OpenC3 cosmos up to 7.0.0-rc2 Script Runner Widget unnecessary privileges

Summaryinfo

A vulnerability identified as critical has been detected in OpenC3 cosmos up to 7.0.0-rc2. Affected by this issue is some unknown functionality of the component Script Runner Widget. Performing a manipulation results in unnecessary privileges. This vulnerability is cataloged as CVE-2026-42088. It is possible to initiate the attack remotely. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in OpenC3 cosmos up to 7.0.0-rc2. This affects some unknown functionality of the component Script Runner Widget. The manipulation with an unknown input leads to a unnecessary privileges vulnerability. CWE is classifying the issue as CWE-250. The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to version 7.0.0-rc3, the Script Runner widget allows users to execute Python and Ruby scripts directly from the openc3-COSMOS-script-runner-api container. Because all the docker containers share a network, users can execute specially crafted scripts to bypass the API permissions check and perform administrative actions, including reading and modifying data inside the Redis database, which can be used to read secrets and change COSMOS settings, as well as read and write to the buckets service, which holds configuration, log, and plugin files. These actions are normally only available from the Admin Console or with administrative privileges. Any user with permission to create and run scripts can connect to any service in the docker network. This issue has been patched in version 7.0.0-rc3.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-42088 since 04/23/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

Upgrading to version 7.0.0-rc3 eliminates this vulnerability. The upgrade is hosted for download at github.com.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• OpenC3

Name

• cosmos

Version

• 7.0.0-rc1
• 7.0.0-rc2

Website

• Product: https://github.com/OpenC3/cosmos/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion