EUVD-2026-27065Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Lifecycle Timeline
5DescriptionGitHub Advisory
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to version 7.0.0-rc3, the Script Runner widget allows users to execute Python and Ruby scripts directly from the openc3-COSMOS-script-runner-api container. Because all the docker containers share a network, users can execute specially crafted scripts to bypass the API permissions check and perform administrative actions, including reading and modifying data inside the Redis database, which can be used to read secrets and change COSMOS settings, as well as read and write to the buckets service, which holds configuration, log, and plugin files. These actions are normally only available from the Admin Console or with administrative privileges. Any user with permission to create and run scripts can connect to any service in the docker network. This issue has been patched in version 7.0.0-rc3.
AnalysisAI
Privilege escalation in OpenC3 COSMOS allows low-privileged authenticated users to bypass API authorization and perform administrative actions by executing crafted Python or Ruby scripts via the Script Runner widget. Attackers can directly access Redis database (exposing secrets and configuration settings) and the MinIO buckets service (containing logs, configs, and plugins) due to unrestricted container-to-container network access in the Docker deployment. Vendor-released patch available in version 7.0.0-rc3 and confirmed in 7.0.0 stable release. EPSS data not available; no CISA KEV listing indicates targeted rather than widespread exploitation. CVSS 9.6 (Critical) with scope change reflects the container escape-like privilege boundary violation.
Technical ContextAI
OpenC3 COSMOS is a command-and-control framework for embedded systems that runs as a multi-container Docker application. The Script Runner API container (openc3-cosmos-script-runner-api) executes user-submitted Python and Ruby scripts with full network access to other containers sharing the default Docker bridge network. The vulnerability stems from CWE-250 (Execution with Unnecessary Privileges): the script execution environment inherits excessive network privileges without enforcing API-level authorization checks. Redis credentials and service endpoints are discoverable via environment variables within the container, allowing direct database manipulation through Python Redis clients or Ruby libraries. The MinIO object storage service (buckets) is similarly accessible without authentication from within the container network. This architectural flaw allows authenticated users with script execution permissions to bypass the intended role-based access control enforced at the web API layer, effectively escalating privileges to administrator-equivalent capabilities. The scope change in CVSS:3.1/S:C indicates the attack crosses a security boundary-from Script Runner container context to administrative control over Redis and storage services.
RemediationAI
Upgrade to OpenC3 COSMOS version 7.0.0-rc3 or later (stable 7.0.0 release available at https://github.com/OpenC3/cosmos/releases/tag/v7.0.0). The patched versions implement network-level access controls preventing Script Runner containers from directly accessing Redis and MinIO services without proper authorization. Organizations upgrading to 7.0.0 must perform a full TSDB cleanup as table names now include scope identifiers-run openc3.sh cleanup (WARNING: drops all logged data) or manually delete the TSDB volume via docker volume rm xxx-tsdb-v. For environments unable to immediately upgrade, implement compensating controls: restrict Script Runner access to administrator accounts only via role-based access control; deploy network segmentation using Docker custom networks with explicit service linking to prevent unrestricted container-to-container communication (TRADE-OFF: requires Docker Compose reconfiguration and may break legitimate script functionality); rotate Redis credentials and implement Redis ACLs limiting script-runner-api container to read-only access where feasible (TRADE-OFF: may impact legitimate administrative scripts). Monitor Redis audit logs and MinIO access logs for unauthorized connections originating from the script-runner-api container IP address. Note that generic defense-in-depth measures are insufficient-this vulnerability requires architectural remediation at the container network layer.
LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild i
UAF in Redis 8.2.1 via crafted Lua scripts by authenticated users. EPSS 12.4%. Patch available.
It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific
Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10,
Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user
Redis before 2.8.21 and 3.x before 3.0.2 allows remote attackers to execute arbitrary Lua bytecode via the eval command.
A buffer overflow in Redis 3.2.x prior to 3.2.4 causes arbitrary code execution when a crafted command is sent. Rated cr
Code injection in OneUptime monitoring via custom JS monitor using vm module. PoC and patch available.
In applications using jfinal 4.9.08 and below, there is a deserialization vulnerability when using redis,may be vulnerab
An issue was found in Apache Airflow versions 1.10.10 and below. Rated critical severity (CVSS 9.8), this vulnerability
An Integer Overflow issue was discovered in the struct library in the Lua subsystem in Redis before 3.2.12, 4.x before 4
goanother Another Redis Desktop Manager =<1.6.1 is vulnerable to Cross Site Scripting (XSS) via src/components/Setting.v
Same weakness CWE-250 – Execution with Unnecessary Privileges
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today