OpenC3 COSMOS Authenticated Remote Code Execution

OpenC3 COSMOS contains a critical vulnerability (CVE-2026-77602) allowing authenticated remote code execution (RCE). The application processes configuration files from a user-writable overlay directory (targets_modified/) before the system-defined read-only targets/ tree. Because the configuration subsystem treats these user-controlled files as templates and executable code, an attacker can leverage several API endpoints - including screen saving, table generation, and storage uploads - to place malicious files in the overlay. These files are then executed via ERB rendering, generic code conversion blocks, or direct inclusion by the script runner suite analysis.

The vulnerability affects versions 5.1.0 through 7.2.1. In the open-source edition, authorization checks fail to enforce permission strings, allowing any authenticated user to exploit the flaw. Successful exploitation results in arbitrary code execution as the openc3 user within the cmd-tlm-api container or target-specific microservices, granting the attacker control over configuration, telemetry, and command data.

Attack Chain

1. Attacker obtains valid authentication credentials for the COSMOS API.
2. Attacker interacts with the /screen endpoint or storage_controller to bypass admin-gated file writing checks.
3. Attacker crafts a malicious configuration file containing an ERB template or a GENERIC_WRITE_CONVERSION code block.
4. Attacker writes the malicious file into the targets_modified/ directory via authorized API calls.
5. Attacker triggers the vulnerability by calling tables#generate, tables#report, or initiating a script_view operation.
6. COSMOS configuration parser reads the malicious file from targets_modified/.
7. The application engine executes the embedded Ruby or Python code within the cmd-tlm-api or script runner container.
8. Attacker gains persistent or immediate arbitrary code execution within the container environment.

Impact

The vulnerability allows arbitrary code execution as the openc3 user. Compromised containers hold Redis and bucket credentials and reside on the internal service network, enabling the attacker to manipulate telemetry, commands, and configurations. In default multi-user deployments, the API is exposed, and even in single-host deployments, the service is reachable via local network paths.

Recommendation

Prioritize patching and restrict access to the affected endpoints.

• Upgrade to a version of OpenC3 COSMOS containing the fix (post-v7.2.1).
• Restrict access to API endpoints involved in configuration and script management, specifically /screen, tables/, and scripts/, to trusted administrative users.
• Audit the targets_modified/ directory for any unexpected or suspicious file modifications.
• Monitor API access logs for anomalous POST requests to configuration-related endpoints originating from non-administrative service accounts.