OpenC3 COSMOS CVE-2026-42087

Requires valid authentication credentials with 'tlm' permission, which is granted by default to Admin, Operator, Viewer, and Runner roles in standard COSMOS deployments. No additional configuration vulnerabilities or non-default settings are required-the flaw exists in default installations of affected versions. Attack is remotely executable (AV:N) against any network-accessible COSMOS instance with standard role-based access control. The vulnerable get_tlm_values endpoint is a core telemetry retrieval function, not an optional feature, meaning all deployments using QuestDB for time-series storage are exposed. Exploitation does NOT require: administrative privileges, physical access, social engineering, or chaining with other vulnerabilities. Limiting factor: attacker must first obtain valid user credentials through phishing, credential stuffing, or insider access. However, low-privilege 'Viewer' accounts intended for dashboard-only access are sufficient, lowering the barrier compared to vulnerabilities requiring administrative roles.

CVSS 9.6 (Critical) with network vector, low complexity, and changed scope accurately reflects the technical severity, but real-world risk requires contextualization. The vulnerability requires low-privilege authentication (PR:L) yet grants disproportionate impact due to COSMOS's permissive default role model-any user with read-only telemetry access can delete mission-critical historical data. Attack complexity is genuinely low (AC:L)-the GitHub advisory includes screenshots of working payloads requiring no specialized tools beyond HTTP clients. Changed scope (S:C) is justified as the vulnerability crosses trust boundaries from application-layer permissions into database-layer operations. However, EPSS data is not provided, and the vulnerability is NOT in CISA KEV, suggesting exploitation remains theoretical or undisclosed. The primary impact is availability (deleting telemetry archives for aerospace/industrial control systems) and confidentiality (exfiltrating sensitive operational data), with integrity risk limited to historical records rather than real-time command streams. Organizations using COSMOS in air-gapped or authentication-gated deployments face lower risk than internet-exposed instances. Critical risk factors: (1) proof-of-concept publicly available since GitHub advisory publication, (2) affects operational technology environments where data integrity is paramount, (3) minimal attacker skill required due to classic SQL injection pattern. Mitigating factors: (1) authentication required, (2) no evidence of active exploitation, (3) patch available in release candidate. Priority is HIGH for production COSMOS deployments managing critical telemetry, MEDIUM for development/testing environments with network exposure.

An aerospace engineer with Viewer role credentials (intended for read-only telemetry monitoring) authenticates to a COSMOS instance managing satellite ground station data. They craft an HTTP POST request to the get_tlm_values RPC endpoint, injecting the payload 1' OR 1=1; DROP TABLE telemetry_archive; -- into the start_time parameter. The vulnerable tsdb_lookup function concatenates this input directly into a SQL query executed against QuestDB, breaking out of the WHERE clause to execute the DROP TABLE command. Within seconds, years of historical telemetry data is permanently deleted, disrupting mission analysis and regulatory compliance. Alternatively, the attacker uses UNION SELECT to exfiltrate proprietary spacecraft performance metrics to a competitor. The GitHub advisory provides working proof-of-concept payloads demonstrating both scenarios.