CVE-2026-42085: OpenC3 COSMOS Path Traversal Vulnerability

CVE-2026-42085 Overview

OpenC3 COSMOS contains a design flaw in the save_tool_config() function that permits authenticated users to write configuration files to arbitrary locations within the shared /plugins directory tree. The platform sends commands to and receives data from embedded systems, making configuration integrity critical to operations. Although the implementation canonicalizes filenames to absolute paths to mitigate standard path traversal, all plugins share the same root directory. Attackers supplying crafted configuration filenames can create arbitrary file structures and overwrite existing configuration files belonging to other plugins. The flaw is tracked under [CWE-23: Relative Path Traversal].

Critical Impact

Authenticated users can overwrite configuration files of other plugins inside the shared /plugins directory, enabling cross-plugin tampering and integrity loss.

Affected Products

• OpenC3 COSMOS versions prior to 6.10.5
• OpenC3 COSMOS 7.x versions prior to 7.0.0-rc3
• Deployments exposing the save_tool_config() API to authenticated users

Discovery Timeline

• 2026-05-04 - CVE-2026-42085 published to NVD
• 2026-05-04 - Last updated in NVD database

Technical Details for CVE-2026-42085

Vulnerability Analysis

The vulnerability resides in the ToolConfigModel class within openc3/lib/openc3/models/tool_config_model.rb. Methods such as save_config, load_config, list_configs, and delete_config accepted tool and name parameters that were used to compose Redis hash keys and on-disk paths under LocalMode.save_tool_config. Standard path traversal sequences such as ../ were partially handled through canonicalization, but no isolation existed between plugin directories. All plugin configurations resolved under the same shared /plugins root.

Client-side validation in SaveConfigDialog.vue only rejected names containing /, \, or .. using a denylist approach. This denylist did not prevent authenticated users from supplying values that, while not containing classic traversal tokens, still resolved to paths overlapping another plugin's namespace. The result is cross-plugin file write and overwrite within the shared root.

Root Cause

The root cause is a design flaw combining shared filesystem scoping with insufficient input validation. The denylist regex /[/\\]|\.\./ rejected obvious traversal but did not enforce a strict character set. Because every plugin shared the /plugins root after canonicalization, any accepted filename could land inside another plugin's directory.

Attack Vector

An authenticated user with access to the configuration save API submits a crafted configName to save_tool_config(). The server canonicalizes the path, places the file under /plugins, and overwrites or creates files outside the caller's intended scope. Network reachability to the COSMOS API is required, and no user interaction is needed.

# Patch: openc3/lib/openc3/models/tool_config_model.rb
# Allowlist replaces the prior denylist for tool and config names
module OpenC3
  class ToolConfigModel
    class InvalidNameError < StandardError; end

    # Allowlist: letters, digits, hyphens, underscores, spaces, and periods
    VALID_NAME_PATTERN = /\A[A-Za-z0-9_\-. ]+\z/

    def self.list_configs(tool, scope: $openc3_scope)
      raise InvalidNameError, "Invalid tool name: #{tool}" unless tool.match?(VALID_NAME_PATTERN)
      Store.hkeys("#{scope}__config__#{tool}")
    end

    def self.load_config(tool, name, scope: $openc3_scope)
      raise InvalidNameError, "Invalid tool name: #{tool}" unless tool.match?(VALID_NAME_PATTERN)
      raise InvalidNameError, "Invalid config name: #{name}" unless name.match?(VALID_NAME_PATTERN)
      Store.hget("#{scope}__config__#{tool}", name)
    end
end
end

Source: OpenC3 Commit e6efccb

Detection Methods for CVE-2026-42085

Indicators of Compromise

• Configuration files appearing under /plugins subdirectories that do not match the owning plugin's namespace
• Unexpected modifications to existing tool configuration files inside the shared /plugins tree
• Application errors referencing Invalid tool name or Invalid config name after upgrading, indicating prior abuse attempts

Detection Strategies

• Audit COSMOS API access logs for calls to save_tool_config containing characters outside [A-Za-z0-9_\-. ] in tool or name parameters
• Compare on-disk plugin configuration inventories against expected baselines to surface cross-plugin writes
• Review Redis hash keys matching *__config__* for entries inconsistent with the owning plugin

Monitoring Recommendations

• Forward COSMOS application logs and filesystem change events to a centralized log platform for correlation
• Alert on file create or modify events under /plugins originating from the COSMOS service account outside expected paths
• Track authentication events tied to users invoking configuration save operations and correlate with file changes

How to Mitigate CVE-2026-42085

Immediate Actions Required

• Upgrade OpenC3 COSMOS to version 6.10.5 or 7.0.0-rc3 or later
• Restrict access to the COSMOS configuration API to trusted operators only
• Inventory current /plugins contents and remove or restore any unexpected configuration files

Patch Information

The issue is fixed in OpenC3 COSMOS 6.10.5 and 7.0.0-rc3. The patch introduces an allowlist regex VALID_NAME_PATTERN = /\A[A-Za-z0-9_\-. ]+\z/ for both tool and name parameters across list_configs, load_config, save_config, and delete_config. Client-side validation in SaveConfigDialog.vue was updated to mirror the same allowlist. See OpenC3 Release v6.10.5, OpenC3 Release v7.0.0-rc3, and GitHub Security Advisory GHSA-4jvx-93h3-f45h.

Workarounds

• Limit the COSMOS user population to highly trusted operators until the upgrade is applied
• Apply filesystem-level access controls to enforce per-plugin directory ownership where possible
• Snapshot the /plugins directory regularly so unauthorized overwrites can be detected and rolled back

# Verify installed OpenC3 COSMOS version and upgrade
docker exec openc3-cosmos-cmd-tlm-api ruby -e 'require "openc3/version"; puts OpenC3::VERSION'

# Pull and deploy patched release
git fetch --tags
git checkout v6.10.5    # or v7.0.0-rc3 for the 7.x line
./openc3.sh stop
./openc3.sh start