Is CVE-2026-42087 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-42087 being exploited in the wild.

How severe is CVE-2026-42087?

Critical severity, with a CVSS score of 9.6, published 4 May 2026.

Which products and versions are affected?

Openc3 Cosmos >= 6.7.0, = 6.7.0, < 7.0.0-rc3, ECOSYSTEM:introduced=6.7.0,fixed=7.0.0-rc3.

Is there a fix for CVE-2026-42087?

Yes. openc3 (PyPI): upgrade to 7.0.0 or later; openc3 (RubyGems): upgrade to 7.0.0-rc3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-42087 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-42087?

Check whether you run Openc3 Cosmos, openc3 (PyPI) or openc3 (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42087: OpenC3 COSMOS SQL injection in QuestDB Time-Series Database

Q: Is there a fix for CVE-2026-42087?

Yes. openc3 (PyPI): upgrade to 7.0.0 or later; openc3 (RubyGems): upgrade to 7.0.0-rc3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-42087 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-42087?

Check whether you run Openc3 Cosmos, openc3 (PyPI) or openc3 (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42087 · Severity: critical · CVSS 9.6 · Published 2026-05-04

OpenC3 COSMOS, a platform for command and control of spacecraft and other systems, contains a security flaw in its telemetry database component. An authenticated user with basic viewing permissions can bypass security controls to view, modify, or delete sensitive historical telemetry data. This could lead to significant data loss or unauthorized disclosure of operational information.

Technologies: Openc3 Cosmos, openc3 (PyPI), openc3 (RubyGems). Vendors: Openc3, PyPI, RubyGems.

Quick answers

Is CVE-2026-42087 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-42087 being exploited in the wild.
How severe is CVE-2026-42087?: Critical severity, with a CVSS score of 9.6, published 4 May 2026.
Which products and versions are affected?: Openc3 Cosmos >= 6.7.0, < 7.0.0-rc3; openc3 (PyPI) ECOSYSTEM:introduced=6.7.0,fixed=7.0.0; openc3 (RubyGems) >= 6.7.0, < 7.0.0-rc3, ECOSYSTEM:introduced=6.7.0,fixed=7.0.0-rc3.
Is there a fix for CVE-2026-42087?: Yes. openc3 (PyPI): upgrade to 7.0.0 or later; openc3 (RubyGems): upgrade to 7.0.0-rc3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42087 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-42087?: Check whether you run Openc3 Cosmos, openc3 (PyPI) or openc3 (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

openc3 (PyPI): upgrade to 7.0.0 or later
```
pip install "openc3>=7.0.0"
```
openc3 (RubyGems): upgrade to 7.0.0-rc3 or later
```
bundle update openc3
```

Technical details

A SQL injection vulnerability exists in the `tsdb_lookup` function within `cvt_model.rb` of the OpenC3 COSMOS Time-Series Database (TSDB) component. The application fails to sanitize user-supplied input before incorporating it into SQL queries executed against QuestDB. An attacker with 'tlm' permissions (available to Admin, Operator, Viewer, or Runner roles) can exploit the `get_tlm_values` RPC endpoint by injecting malicious SQL into the `start_time` parameter. This allows for arbitrary SQL execution, enabling the attacker to bypass intended query logic to retrieve all database records or drop tables. The issue is addressed in version 7.0.0-rc3.

Affected products

OpenC3 COSMOS >= 6.7.0, < 7.0.0-rc3

Identifiers

CVE-2026-42087
GHSA-v529-vhwc-wfc5
PYSEC-2026-2244

Timeline

2026-04-20: disclosed: Initial disclosure to vendor
2026-04-23: advisory: GitHub Advisory published
2026-05-04: advisory: NVD published CVE-2026-42087

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.