# CVE-2026-42087: OpenC3 COSMOS SQL injection in QuestDB Time-Series Database

Source: https://junglewise.ai/threats/cve-2026-42087-openc3-cosmos-sql-injection-in-questdb-time-series-database  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-04. Updated: 2026-05-29  
License: CC BY 4.0 with a link back

CVE-2026-42087 · Severity: critical · CVSS 9.6 · Published 2026-05-04

OpenC3 COSMOS, a platform for command and control of spacecraft and other systems, contains a security flaw in its telemetry database component. An authenticated user with basic viewing permissions can bypass security controls to view, modify, or delete sensitive historical telemetry data. This could lead to significant data loss or unauthorized disclosure of operational information.

Technologies: [Openc3 Cosmos](https://junglewise.ai/threats/technologies/cosmos), [openc3 (PyPI)](https://junglewise.ai/threats/technologies/pypi-openc3), [openc3 (RubyGems)](https://junglewise.ai/threats/technologies/openc3). Vendors: [Openc3](https://junglewise.ai/threats/vendors/openc3), [PyPI](https://junglewise.ai/threats/vendors/pypi), [RubyGems](https://junglewise.ai/threats/vendors/rubygems).

## Quick answers

**Is CVE-2026-42087 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42087 being exploited in the wild.

**How severe is CVE-2026-42087?** Critical severity, with a CVSS score of 9.6, published 4 May 2026.

**Which products and versions are affected?** Openc3 Cosmos >= 6.7.0, < 7.0.0-rc3; openc3 (PyPI) ECOSYSTEM:introduced=6.7.0,fixed=7.0.0; openc3 (RubyGems) >= 6.7.0, < 7.0.0-rc3, ECOSYSTEM:introduced=6.7.0,fixed=7.0.0-rc3.

**Is there a fix for CVE-2026-42087?** Yes. openc3 (PyPI): upgrade to 7.0.0 or later; openc3 (RubyGems): upgrade to 7.0.0-rc3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-42087 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-42087?** Check whether you run Openc3 Cosmos, openc3 (PyPI) or openc3 (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- openc3 (PyPI): upgrade to 7.0.0 or later

  ```sh
  pip install "openc3>=7.0.0"
  ```

- openc3 (RubyGems): upgrade to 7.0.0-rc3 or later

  ```sh
  bundle update openc3
  ```


## Technical details

A SQL injection vulnerability exists in the `tsdb_lookup` function within `cvt_model.rb` of the OpenC3 COSMOS Time-Series Database (TSDB) component. The application fails to sanitize user-supplied input before incorporating it into SQL queries executed against QuestDB. An attacker with 'tlm' permissions (available to Admin, Operator, Viewer, or Runner roles) can exploit the `get_tlm_values` RPC endpoint by injecting malicious SQL into the `start_time` parameter. This allows for arbitrary SQL execution, enabling the attacker to bypass intended query logic to retrieve all database records or drop tables. The issue is addressed in version 7.0.0-rc3.

## Affected products

- OpenC3 COSMOS >= 6.7.0, < 7.0.0-rc3

## Identifiers

- CVE-2026-42087
- GHSA-v529-vhwc-wfc5
- PYSEC-2026-2244

## Timeline

- 2026-04-20: disclosed: Initial disclosure to vendor
- 2026-04-23: advisory: GitHub Advisory published
- 2026-05-04: advisory: NVD published CVE-2026-42087

## References

- [https://api.github.com/users/suffs811](https://api.github.com/users/suffs811)
- [https://github.com/suffs811](https://github.com/suffs811)
- [https://api.github.com/users/suffs811/gists%7B/gist_id%7D](https://api.github.com/users/suffs811/gists%7B/gist_id%7D)
- [https://api.github.com/users/suffs811/repos](https://api.github.com/users/suffs811/repos)
- [https://avatars.githubusercontent.com/u/84633135?v=4](https://avatars.githubusercontent.com/u/84633135?v=4)
- [https://api.github.com/users/suffs811/events%7B/privacy%7D](https://api.github.com/users/suffs811/events%7B/privacy%7D)

## Related threats

- [OpenC3 COSMOS authenticated remote code execution via config overlay](https://junglewise.ai/threats/cve-2026-77602-openc3-cosmos-authenticated-remote-code-execution-via-config)
- [OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.12.0 until 7.](https://junglewise.ai/threats/cve-2026-77601-openc3-cosmos-authenticated-os-command-injection-via-pypi-url)
- [OpenC3 COSMOS stored cross-user XSS in BUTTON widget](https://junglewise.ai/threats/cve-2026-77394-openc3-cosmos-stored-cross-user-xss-in-button-widget)
- [OpenC3 COSMOS privilege escalation via Script Runner API bypass](https://junglewise.ai/threats/cve-2026-42088-openc3-cosmos-privilege-escalation-via-script-runner-api-bypass)
- [OpenC3 COSMOS Self-XSS in Command Sender](https://junglewise.ai/threats/cve-2026-42086-openc3-cosmos-self-xss-in-command-sender)