CVE-2026-42087: OpenC3 COSMOS SQL injection in QuestDB Time-Series Database

Executive brief

OpenC3 COSMOS, a platform for command and control of spacecraft and other systems, contains a security flaw in its telemetry database component. An authenticated user with basic viewing permissions can bypass security controls to view, modify, or delete sensitive historical telemetry data. This could lead to significant data loss or unauthorized disclosure of operational information.

Technical details

A SQL injection vulnerability exists in the `tsdb_lookup` function within `cvt_model.rb` of the OpenC3 COSMOS Time-Series Database (TSDB) component. The application fails to sanitize user-supplied input before incorporating it into SQL queries executed against QuestDB. An attacker with 'tlm' permissions (available to Admin, Operator, Viewer, or Runner roles) can exploit the `get_tlm_values` RPC endpoint by injecting malicious SQL into the `start_time` parameter. This allows for arbitrary SQL execution, enabling the attacker to bypass intended query logic to retrieve all database records or drop tables. The issue is addressed in version 7.0.0-rc3.

Affected products

• OpenC3 COSMOS >= 6.7.0, < 7.0.0-rc3

Timeline

• 2026-04-20: disclosed: Initial disclosure to vendor
• 2026-04-23: advisory: GitHub Advisory published
• 2026-05-04: advisory: NVD published CVE-2026-42087

References

• https://api.github.com/users/suffs811
• https://github.com/suffs811
• https://api.github.com/users/suffs811/gists%7B/gist_id%7D
• https://api.github.com/users/suffs811/repos
• https://avatars.githubusercontent.com/u/84633135?v=4
• https://api.github.com/users/suffs811/events%7B/privacy%7D