CVE-2026-77602: OpenC3 COSMOS authenticated remote code execution via config overlay

CVE-2026-77602 · Severity: critical · CVSS 9.9 · Published 2026-09-23

OpenC3 COSMOS is a widely-used satellite operations and command/telemetry system. The platform reads configuration files from a user-writable overlay directory before protected system files, and automatically executes code embedded in those files through three separate code paths (table definitions, telemetry definitions, and script analysis). An authenticated user with basic permissions can inject malicious configuration into the overlay and gain arbitrary code execution as the openc3 service user, compromising all connected satellites and operations across the entire deployment.

Technologies: Openc3 Cosmos, openc3 (RubyGems). Vendors: Openc3, RubyGems.

Quick answers

Is CVE-2026-77602 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-77602 being exploited in the wild.
How severe is CVE-2026-77602?
Critical severity, with a CVSS score of 9.9, published 23 September 2026.
Which products and versions are affected?
Openc3 Cosmos All versions prior to fix; openc3 (RubyGems) >= 5.1.0, <= 7.2.1, ECOSYSTEM:introduced=5.1.0,fixed=7.3.0.
Is there a fix for CVE-2026-77602?
Yes. openc3 (RubyGems): upgrade to 7.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-77602 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-77602?
Check whether you run Openc3 Cosmos or openc3 (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • openc3 (RubyGems): upgrade to 7.3.0 or later
    bundle update openc3

Technical details

Three distinct RCE vectors exist in the config loading subsystem. First, table definitions are ERB-rendered and GENERIC conversion blocks are eval'd via the tables API (routes `tables#generate`, `tables#report`, `tables#load`). Second, cmd/telm definitions undergo the same ERB and GENERIC processing during system initialization and are triggered on microservice restart. Third, Script Runner procedures are directly `require`d during suite analysis at the `script_view` tier. All three sinks receive attacker-controlled content from the user-writable `targets_modified/` overlay directory, which takes precedence over read-only plugin files. The storage-upload endpoint and screen-save endpoint allow non-admin authenticated users to write into `targets_modified/` with insufficient validation. The open-source edition's `authorize` function ignores permission strings, so any authenticated user can trigger exploitation regardless of role. Patches should disable ERB in overlay parsing, restrict `cmd_tlm` writes to admin-only, and enforce the `script_run` tier for suite analysis.

Affected products

  • OpenC3 COSMOS All versions prior to fix

Identifiers

  • CVE-2026-77602
  • GHSA-jjq7-m736-w977

Timeline

  • 2026-09-23: disclosed: GHSA-jjq7-m736-w977 published
  • 2026: other: CVE-2026-77602 assigned

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.