CVE-2026-49447

Received Received - Intake

Information Disclosure in Cosmos Home Server

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: GitHub, Inc.

Description

Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. In 0.22.18, `GET /cosmos/api/constellation/public-devices` discloses Constellation device metadata to a requester that supplies any non-empty Authorization header. The handler strips the string Bearer from the header but never validates the resulting token and never uses it in the database query. This vulnerability is fixed in 0.22.19.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-28

Last Modified

2026-07-28

Generated

2026-07-29

AI Q&A

2026-07-29

EPSS Evaluated

N/A

NVD

CVE-2026-49447

Affected Vendors & Products

Vendor	Product	Version / Range
cosmos	cosmos	0.22.19

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

In Cosmos version 0.22.18, an endpoint GET /cosmos/api/constellation/public-devices exposes Constellation device metadata when any non-empty Authorization header is provided. The system removes the Bearer prefix from the header but fails to validate the token or use it in the database query, allowing unauthorized access to metadata.

Detection Guidance

Check if your Cosmos server version is 0.22.18 or earlier. Use curl to test the endpoint: curl -H 'Authorization: Bearer test' http://your-server/cosmos/api/constellation/public-devices. If metadata is returned without a valid token, the system is vulnerable.

Impact Analysis

This vulnerability allows attackers to retrieve device metadata without proper authentication, potentially exposing sensitive information about Constellation devices. The impact is limited to information disclosure as no modification or deletion of data is possible.

Compliance Impact

This vulnerability could lead to non-compliance with data protection regulations like GDPR or HIPAA by exposing sensitive device metadata without proper authorization, potentially violating privacy and security requirements.

Mitigation Strategies

Upgrade Cosmos to version 0.22.19 or later immediately. Ensure no sensitive metadata is exposed by verifying the fix with the curl command mentioned in detection steps.

Hi! I’m here to help you understand CVE-2026-49447. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70