OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to version 7.0.0-rc3, the Script Runner widget allows users to execute Python and Ruby scripts directly from the openc3-COSMOS-script-runner-api container. Because all the docker containers share a network, users can execute specially crafted scripts to bypass the API permissions check and perform administrative actions, including reading and modifying data inside the Redis database, which can be used to read secrets and change COSMOS settings, as well as read and write to the buckets service, which holds configuration, log, and plugin files. These actions are normally only available from the Admin Console or with administrative privileges. Any user with permission to create and run scripts can connect to any service in the docker network. This issue has been patched in version 7.0.0-rc3.
The Widget Script Runner allows users to execute Python and Ruby scripts directly from the openc3-COSMOS-script-runner-api container. Since all Docker containers share the same internal network, a crafted script can establish direct connections to any services in this network, bypassing API permission verification mechanisms. This enables access to the Redis database (reading secrets, changing COSMOS settings) and to the bucket service storing configuration files, logs, and plugins. These actions normally require administrative privileges or access to the Admin Console.
An attacker with permissions to create and run scripts can read sensitive data (secrets, configuration), modify the entire COSMOS system settings, and read and overwrite configuration files, logs, and plugins — without possessing administrative privileges.
OpenC3 COSMOS should be updated to version 7.0.0-rc3 or newer (including 7.0.0). Patches available in vendor references on GitHub: https://github.com/OpenC3/cosmos/releases/tag/v7.0.0-rc3
OpenC3 COSMOS in versions prior to 7.0.0-rc3
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:NOpenc3 Cosmos
APPOpenc37.0.0< 7.0.0
Related vulnerabilities
SQL Injection w komponencie TSDB OpenC3 COSMOS (CVE-2026-42087)
Path Traversal w endpoincie /script-api/scripts/ OpenC3 COSMOS
RCE w komponencie Plugin Management OpenC3 COSMOS poprzez spreparowany plik .txt
OpenC3 COSMOS — hardcoded credentials w koncie Service Account
OpenC3 COSMOS: Obejście uwierzytelnienia przez słabe wymagania haseł