CVE-2026-77602: OpenC3 COSMOS RCE Vulnerability

CVE-2026-77602 Overview

OpenC3 COSMOS contains a code injection vulnerability [CWE-94] that allows authenticated non-administrator users to execute arbitrary Ruby, Python, or ERB code on the server. The flaw affects versions from 5.1.0 up to but not including 7.3.0. Attackers can write content into the targets_modified/ overlay through storage uploads, screen saves, or script creation. Triggering table processing, a cmd/tlm reload, or suite analysis causes the injected content to execute inside cmd-tlm-api, decom microservices, or Script Runner with access to internal credentials and data.

Critical Impact

Authenticated low-privilege users can achieve arbitrary code execution across multiple COSMOS microservices, exposing internal credentials and telemetry data used to control embedded systems.

Affected Products

• OpenC3 COSMOS versions 5.1.0 through 7.2.x
• openc3-cosmos-cmd-tlm-api component
• openc3-cosmos-script-runner-api component (including run_suite_analysis.rb)

Discovery Timeline

• 2026-09-23 - CVE-2026-77602 published to NVD
• 2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-77602

Vulnerability Analysis

OpenC3 COSMOS treats the targets_modified/ overlay as an equal source of configuration data alongside the read-only plugin-installed targets/ tree. Configuration files loaded from this overlay pass through ConfigParser, PacketConfig, GENERIC_READ_CONVERSION, and GENERIC_WRITE_CONVERSION. Each of these processors evaluates ERB templates, Ruby code, or Python code during load.

Suite analysis compounds the issue. The file openc3-cosmos-script-runner-api/scripts/run_suite_analysis.rb loads suite procedure files through require, which executes their contents. A non-administrator user with write access to the overlay can therefore stage code that is executed the next time table processing, a cmd/tlm reload, or a suite analysis runs.

Root Cause

The underlying design flaw is trust boundary confusion: user-writable content in targets_modified/ was consumed by code paths that expected data from the trusted plugin-installed tree. Multiple write surfaces (storage_controller, tables_controller, screen save, and script creation endpoints) placed attacker-controlled content into a location later interpreted as executable configuration.

Attack Vector

An authenticated user with the system role writes a crafted table definition, screen, script, or storage object into the overlay. A follow-up request that reloads cmd/tlm definitions or triggers suite analysis causes the server to render the ERB template or evaluate the embedded conversion blocks, resulting in code execution inside the affected microservice.

# Patch: openc3-cosmos-cmd-tlm-api/app/models/table.rb
# Force definitions to load from the read-only plugin tree, not the overlay.
def self.get_definitions(scope, definition_filename, binary_filename = nil)
  # Definitions are ERB-rendered and their GENERIC_*_CONVERSION blocks are
  # evaluated as code by TableConfig, so they must come from the read-only
  # plugin-installed targets/ tree only. Reading the user-writable
  # targets_modified/ overlay here would be arbitrary code execution.
  definition = body(scope, definition_filename, original: true)
  # ...
end

Source: GitHub Commit 71943352

# Patch: openc3-cosmos-cmd-tlm-api/app/controllers/tables_controller.rb
# Gate overlay writes behind an explicit admin authorization check.
return unless authorization('system')
scope, binary, definition = sanitize_params([:scope, :binary, :definition], require_params: false, allow_forward_slash: true)
return unless scope
return unless authorize_overlay_write(binary)
begin
  Table.save(scope, binary, definition, params[:tables])
  head :ok

Source: GitHub Commit 7a1538a4

Detection Methods for CVE-2026-77602

Indicators of Compromise

• Unexpected files written under targets_modified/ by non-administrator accounts, particularly .txt table definitions, screen files, or suite scripts containing ERB tags (<%= %>) or GENERIC_READ_CONVERSION / GENERIC_WRITE_CONVERSION blocks.
• Log entries from cmd-tlm-api, decom microservices, or Script Runner showing configuration reloads or require calls immediately following overlay writes.
• Outbound network connections or process spawns originating from the COSMOS microservice containers that do not match normal telemetry workflows.

Detection Strategies

• Monitor HTTP requests to storage_controller, tables_controller, screen save, and script creation endpoints for authenticated users lacking administrative roles.
• Alert on any invocation of run_suite_analysis.rb that follows a recent write to targets_modified/ within a short time window.
• Inspect stored overlay content for Ruby or Python evaluation primitives such as eval, system, IO.popen, or exec inside conversion definitions.

Monitoring Recommendations

• Enable audit logging on the COSMOS API containers and forward events to a centralized SIEM for correlation with user identity and role.
• Baseline normal overlay write patterns and alert on deviations, especially writes touching files consumed by ConfigParser or PacketConfig.
• Track service account credential usage from within COSMOS microservices to detect post-exploitation lateral movement.

How to Mitigate CVE-2026-77602

Immediate Actions Required

• Upgrade OpenC3 COSMOS to version 7.3.0 or later, which reclassifies the overlay as data and adds admin authorization gates on overlay writes.
• Audit existing content in targets_modified/ for ERB tags, GENERIC_*_CONVERSION blocks, or unexpected require targets before running any cmd/tlm reload or suite analysis.
• Rotate any credentials or secrets accessible to cmd-tlm-api, decom microservices, and Script Runner if unauthorized overlay writes are suspected.

Patch Information

The fix is released in OpenC3 COSMOS 7.3.0. Two commits address the issue: 71943352a28128ef3e7e894319d97a656b5cd4f2 forces definition loads from the read-only plugin tree, and 7a1538a4626f82c0d1540fcaa27ffdcbbd71ff81 restricts overlay writes in tables_controller to administrators. Full details are documented in GitHub Security Advisory GHSA-jjq7-m736-w977 and Pull Request #3488.

Workarounds

• Restrict the system role and any role permitting overlay writes to fully trusted administrators until the upgrade is applied.
• Disable or block the suite analysis endpoint and cmd/tlm reload paths for non-administrative users at a reverse proxy or WAF.
• Make targets_modified/ read-only where operationally feasible, and require code review before promoting changes into the overlay.

# Example: pin OpenC3 COSMOS to the patched version
docker pull openc3inc/openc3-cosmos-cmd-tlm-api:7.3.0
docker pull openc3inc/openc3-cosmos-script-runner-api:7.3.0

# Verify the running version
curl -s http://<cosmos-host>/openc3-api/version | jq .