CVE-2026-49447: Cosmos Information Disclosure Vulnerability

CVE-2026-49447 Overview

Cosmos-Server is a self-hosted home server platform that acts as a secure gateway to applications and provides server management capabilities. CVE-2026-49447 is an authentication bypass vulnerability [CWE-287] in Cosmos-Server version 0.22.18. The GET /cosmos/api/constellation/public-devices endpoint discloses Constellation device metadata to any requester that supplies a non-empty Authorization header. The handler strips the Bearer prefix from the header but never validates the resulting token and never binds it to the database query. The maintainer released a fix in version 0.22.19.

Critical Impact
Unauthenticated attackers on the network can retrieve Constellation VPN device metadata by sending any arbitrary value in the Authorization header.

Affected Products

Cosmos-Server version 0.22.18
Constellation VPN feature exposed via /cosmos/api/constellation/public-devices
Self-hosted Cosmos-Server deployments prior to 0.22.19

Discovery Timeline

2026-07-28 - CVE-2026-49447 published to NVD
2026-07-29 - Last updated in NVD database
v0.22.19 - Maintainer azukaar released the patched version on GitHub

Technical Details for CVE-2026-49447

Vulnerability Analysis

The flaw resides in the handler for GET /cosmos/api/constellation/public-devices. The endpoint is intended to return metadata about Constellation devices to authenticated users. Instead, it performs only a superficial parse of the Authorization header. Any string supplied by the client is accepted as authentication material. The handler then executes a database query that does not incorporate the token or any identity claim. As a result, device metadata is returned to any client that includes a non-empty Authorization header value.

Root Cause

The root cause is missing authentication [CWE-287]. The handler strips the literal prefix Bearer from the incoming header, but the resulting token is never validated against a session store, JWT signature, or user record. The token is also never used as a filter in the database lookup, so no implicit scoping by identity occurs. A single non-empty header value bypasses the intended access control.

Attack Vector

Exploitation requires only network access to the Cosmos-Server HTTP interface. No credentials, user interaction, or prior foothold are needed. An attacker sends a single HTTP GET request to /cosmos/api/constellation/public-devices with any non-empty Authorization header. The server responds with Constellation device metadata, which can be used to enumerate the VPN topology and plan follow-on activity.

// Example request illustrating the missing validation
GET /cosmos/api/constellation/public-devices HTTP/1.1
Host: <cosmos-server>
Authorization: Bearer anything

See the GitHub Security Advisory GHSA-5fqm-cc34-fcf5 for the vendor description of the flaw.

Detection Methods for CVE-2026-49447

Indicators of Compromise

Requests to /cosmos/api/constellation/public-devices from unexpected source IP addresses.
Requests with malformed, static, or repeated Authorization: Bearer header values.
Successful HTTP 200 responses to that path from clients that never completed a Cosmos login flow.

Detection Strategies

Inspect Cosmos-Server access logs for GET /cosmos/api/constellation/public-devices requests and correlate them against known authenticated sessions.
Deploy a web application firewall rule that flags requests to the affected path with token values that do not match issued session tokens.
Compare the Cosmos-Server version reported by the admin console against 0.22.19 or later to identify vulnerable hosts.

Monitoring Recommendations

Forward Cosmos-Server HTTP logs to a centralized log store and alert on access to Constellation API paths from non-management network segments.
Baseline normal client user-agents and IPs that call the /cosmos/api/constellation/* endpoints and alert on deviations.
Track the frequency of Authorization header parse events and investigate spikes.

How to Mitigate CVE-2026-49447

Immediate Actions Required

Upgrade Cosmos-Server to version 0.22.19 or later, which contains the fix committed in commit 59c561d.
Restrict network exposure of the Cosmos-Server management interface to trusted networks or a management VPN until the upgrade is applied.
Review Constellation device inventory for signs of enumeration by unknown clients.

Patch Information

The maintainer released Cosmos-Server v0.22.19 with the fix for /cosmos/api/constellation/public-devices. The patch changes the handler and related client APIs so that the token from the Authorization header is validated before device metadata is returned. Refer to the GitHub commit for the full diff.

Workarounds

Block external access to /cosmos/api/constellation/public-devices at a reverse proxy until the upgrade is deployed.
Place Cosmos-Server behind an authenticating reverse proxy that enforces its own session check before requests reach Cosmos.
Limit source IP ranges permitted to reach the Cosmos HTTP interface using host firewall rules.

bash

# Example nginx snippet to block the vulnerable path until patched
location = /cosmos/api/constellation/public-devices {
    return 403;
}