Executive brief
OpenC3 COSMOS is a platform used to control and receive data from embedded systems, such as satellites or industrial hardware. A security flaw in the Script Runner tool allows users with basic script-running permissions to bypass security checks and perform administrative actions. This could allow an attacker to steal sensitive secrets, modify system settings, or tamper with critical configuration and log files, potentially compromising the entire command and control infrastructure.
Technical details
A vulnerability in the Script Runner widget of OpenC3 COSMOS (prior to version 7.0.0-rc3) allows users to execute Python and Ruby scripts within the 'openc3-COSMOS-script-runner-api' container. Because the Docker containers share a common network, an authenticated attacker can use specially crafted scripts to bypass API permission checks. This grants direct access to internal services such as the Redis database (used for secrets and settings) and the buckets service (used for configuration, logs, and plugins). The flaw is categorized as CWE-250 (Execution with Unnecessary Privileges) and allows a low-privileged user to escalate to administrative control. The issue has been addressed in version 7.0.0-rc3 and the final 7.0.0 release.
Affected products
- OpenC3 COSMOS < 7.0.0-rc3
Timeline
- 2026-03-06: patched: Version 7.0.0-rc3 released
- 2026-03-26: patched: Version 7.0.0 final released
- 2026-04-20: advisory: GitHub Security Advisory published
- 2026-05-04: disclosed: CVE published to NVD