What is the CVSS score of CVE-2026-42087?

CVE-2026-42087 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of OpenC3 COSMOS are affected by CVE-2026-42087?

OpenC3 COSMOS versions 6.7.0 through 7.0.0-rc2 contain a SQL injection vulnerability in the telemetry data retrieval function that allows authenticated users with basic viewer permissions to execute…. A patch is available.

How to fix or mitigate CVE-2026-42087?

Within 24 hours: Identify all OpenC3 COSMOS deployments running versions 6.7.0 through 7.0.0-rc2 and document current user privilege assignments, especially 'tlm' role holders. Within 7 days: Upgrade affected instances to version 7.0.0-rc3 or later (minimum commit 9ba60c0); if production constraints prevent immediate upgrade, implement network-layer access controls restricting the get_tlm_values RPC endpoint to trusted internal sources only. Within 30 days: Audit database access logs for suspicious SQL patterns; review and enforce principle of least privilege for all 'tlm' role assignments; conduct security training on SQL injection risks for development teams.

OpenC3 COSMOS CVE-2026-42087

EUVD-2026-27063 CRITICAL

SQL Injection (CWE-89)

2026-05-04 GitHub_M

GHSA-v529-vhwc-wfc5

SQLi Cosmos

9.6

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

May 04, 2026 - 19:17 EUVD

Source Code Evidence Fetched

May 04, 2026 - 18:01 vuln.today

Analysis Generated

May 04, 2026 - 18:01 vuln.today

Analysis Generated

May 04, 2026 - 17:45 vuln.today

CVE Published

May 04, 2026 - 17:18 nvd

CRITICAL 9.6

DescriptionGitHub Advisory

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From version 6.7.0 to before version 7.0.0-rc3, a SQL injection vulnerability exists in the Time-Series Database (TSDB) component of COSMOS. The tsdb_lookup function in the cvt_model.rb file directly places user-supplied input into a SQL query without sanitizing the input. As a result, a user can break out of the initial SQL statement and execute arbitrary SQL commands, including deleting data. This issue has been patched in version 7.0.0-rc3.

AnalysisAI

SQL injection in OpenC3 COSMOS 6.7.0 to 7.0.0-rc2 allows authenticated users with minimal 'tlm' (telemetry viewer) privileges to execute arbitrary SQL commands against the QuestDB time-series database. Attackers can exfiltrate all telemetry data, drop tables, or manipulate historical records via the get_tlm_values RPC endpoint by injecting malicious SQL into the start_time parameter. Vendor-released patch available in version 7.0.0-rc3 (commit 9ba60c0). No active exploitation confirmed (not in CISA KEV), but GitHub advisory includes working proof-of-concept payloads demonstrating both data extraction and table deletion.

Technical ContextAI

The vulnerability resides in the tsdb_lookup function within cvt_model.rb (Ruby) and cvt_model.py (Python), which construct SQL queries for QuestDB (a time-series database optimized for telemetry storage) by directly concatenating user-supplied start_time and end_time parameters into WHERE clauses. The affected code performs string interpolation (e.g., WHERE T0.PACKET_TIMESECONDS < '#{start_time}') rather than parameterized queries, violating CWE-89 SQL injection prevention guidance. QuestDB supports PostgreSQL wire protocol, making it susceptible to classic SQL injection techniques including UNION-based data extraction and DDL statement execution (DROP TABLE). The get_tlm_values endpoint exposes this function to any authenticated user with 'tlm' permission (granted to Admin, Operator, Viewer, and Runner roles by default), significantly expanding the attack surface beyond privileged administrators. The patch (commit 9ba60c0) replaces string concatenation with parameterized queries using exec_params (Ruby) and cursor.execute with placeholder parameters (Python), binding user input as query parameters rather than embedding it in the SQL string.

RemediationAI

Upgrade to OpenC3 COSMOS version 7.0.0-rc3 or later, which replaces string interpolation with parameterized queries (commit 9ba60c09c8836a37a2e4ea67ab35fe403e041415). Release available at https://github.com/OpenC3/cosmos/releases/tag/v7.0.0-rc3. If immediate patching is not feasible, implement these compensating controls with noted trade-offs: (1) Restrict 'tlm' permission to only trusted users-audit role assignments in COSMOS configuration to remove Viewer/Runner roles from untrusted accounts, though this breaks read-only telemetry access workflows. (2) Deploy web application firewall (WAF) rules to block SQL metacharacters (single quotes, semicolons, UNION keywords) in start_time/end_time parameters of /openc3-api/api requests to get_tlm_values endpoint, though sophisticated attackers may bypass signature-based filters using encoding. (3) Enable QuestDB query logging and monitor for abnormal queries containing DROP, ALTER, or UNION statements originating from COSMOS application user, though this provides detection rather than prevention. (4) Network segmentation: isolate COSMOS instances on non-routable networks accessible only via VPN with multi-factor authentication, reducing attack surface but not eliminating insider threat risk. No compensating control fully mitigates the vulnerability-patching remains the definitive solution.