CVE-2026-77602
Deferred Deferred - Pending Action

Privilege Escalation in OpenC3 COSMOS via Malicious Content Execution

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: GitHub, Inc.

Description
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.1.0 until 7.3.0, authenticated non-administrator users can write content under targets_modified/ that is later executed by multiple configuration paths below the intended code-execution privilege tier. Table and command or telemetry definitions are processed through ConfigParser, PacketConfig, GENERIC_READ_CONVERSION, or GENERIC_WRITE_CONVERSION, allowing ERB rendering or Ruby and Python evaluation, while openc3-cosmos-script-runner-api/scripts/run_suite_analysis.rb executes suite procedure files through require. Storage uploads, screen saves, and script creation can place content in the overlay, and triggering table processing, a cmd/tlm reload, or suite analysis executes the content in cmd-tlm-api, decom microservices, or Script Runner with access to internal credentials and data. This issue is fixed in version 7.3.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-24
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-77602
EUVD
EUVD-2026-85566

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
openc3 cosmos From 5.1.0 (inc) to 7.3.0 (inc)
openc3 cosmos 5.1.0
openc3 cosmos to 7.3.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in OpenC3 COSMOS allows authenticated non-admin users to execute arbitrary code on the server by writing malicious content to the targets_modified/ overlay directory. The system processes configuration files from this writable directory before the read-only plugin directory, executing embedded code in ERB templates or GENERIC_READ_CONVERSION and GENERIC_WRITE_CONVERSION blocks. Multiple routes exist for exploitation, including table definitions, command/telemetry definitions, and script suites.

Detection Guidance

Detecting this vulnerability requires checking for unauthorized files in writable overlay directories like targets_modified/ and cmd_tlm. Inspect directories for unexpected ERB, Ruby, or Python files. Review logs for cmd/tlm reloads, table processing, or suite analysis triggered by non-admin users. Check for files uploaded via screen save or storage endpoints in user-writable paths.

Impact Analysis

An attacker could gain arbitrary code execution as the openc3 user across multiple microservices. This grants access to sensitive data like Redis credentials, bucket storage, and internal service networks. Exploitation could lead to data breaches, service disruption, or full system compromise depending on the attacker's goals.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and access controls. It enables unauthorized code execution that could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles and HIPAA's security rule requirements for access controls and integrity.

Mitigation Strategies

Upgrade to OpenC3 COSMOS version 7.3.0 or later. Restrict write access to cmd_tlm overlay to admin users only. Disable ERB rendering for configuration files in writable overlays. Treat targets_modified/ as data, not executable code. Validate all file paths to prevent canonicalization bypasses.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77602. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart