Executive brief
OpenC3 COSMOS is a widely-used satellite operations and command/telemetry system. The platform reads configuration files from a user-writable overlay directory before protected system files, and automatically executes code embedded in those files through three separate code paths (table definitions, telemetry definitions, and script analysis). An authenticated user with basic permissions can inject malicious configuration into the overlay and gain arbitrary code execution as the openc3 service user, compromising all connected satellites and operations across the entire deployment.
Technical details
Three distinct RCE vectors exist in the config loading subsystem. First, table definitions are ERB-rendered and GENERIC conversion blocks are eval'd via the tables API (routes `tables#generate`, `tables#report`, `tables#load`). Second, cmd/telm definitions undergo the same ERB and GENERIC processing during system initialization and are triggered on microservice restart. Third, Script Runner procedures are directly `require`d during suite analysis at the `script_view` tier. All three sinks receive attacker-controlled content from the user-writable `targets_modified/` overlay directory, which takes precedence over read-only plugin files. The storage-upload endpoint and screen-save endpoint allow non-admin authenticated users to write into `targets_modified/` with insufficient validation. The open-source edition's `authorize` function ignores permission strings, so any authenticated user can trigger exploitation regardless of role. Patches should disable ERB in overlay parsing, restrict `cmd_tlm` writes to admin-only, and enforce the `script_run` tier for suite analysis.
Affected products
- OpenC3 COSMOS All versions prior to fix
Timeline
- 2026-09-23: disclosed: GHSA-jjq7-m736-w977 published
- 2026: other: CVE-2026-77602 assigned