CVE-2026-42084 json
OpenC3 COSMOS: Hijacked session token can be used to reset password for persistence
published 2026-04-22 6 mo ago modified 2026-10-26 13 d ago also EUVD-2026-27057 , GHSA-wgx6-g857-jjf7 , PYSEC-2026-2242
- cvss
- 8.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 23%
- public exploits
- 0
- none known
Summary
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to versions 6.10.5 and 7.0.0-rc3, the OpenC3 password change functionality allows a user to change their password without providing the old password, by accepting a valid session token instead. In assumed breach scenarios, this behaviour can be exploited by an attacker who has already obtained a valid session token, to gain persistence in hijacked account (including admin) and prevent legitimate users from accessing the account. This issue has been patched in versions 6.10.5 and 7.0.0-rc3.
Patch / fix
- rubygems openc3 6.10.5, 7.0.0-rc3
- pypi openc3 6.10.5
- openc3 cosmos 6.10.5, 7.0.0-rc3
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- total
- Assessed
- 6 mo ago
Exploit prediction
0.30% chance of exploitation in the next 30 days, higher than 23% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/OpenC3/cosmos/security/advisories/GHSA-wgx6-g857-jjf7 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
| GitHub | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
| OSV | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| rubygems | openc3 | <6.10.5 >=7.0.0.pre.rc1, <7.0.0-rc3 |
6.10.5 7.0.0-rc3 |
| pypi | openc3 | <6.10.5 |
6.10.5 |
Affected products
- OpenC3 cosmos
Classification
- Weakness
-
- CWE-620 Unverified Password Change
References
-
github.com
/OpenC3/cosmos/commit/2e623714e3426d5ae81b6f8239d4a2a6937ef776
web, patch
-
github.com
/OpenC3/cosmos/security/advisories/GHSA-wgx6-g857-jjf7
exploit, web, vendor-advisory, evidence
-
github.com
/OpenC3/cosmos/releases/tag/v6.10.5
web, release-notes, advisory
-
github.com
/OpenC3/cosmos/releases/tag/v7.0.0-rc3
web, release-notes, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-42084
advisory
-
github.com
/OpenC3/cosmos
package
-
github.com
/rubysec/ruby-advisory-db/blob/master/gems/openc3/CVE-2026-42084.yml
web
Sources
- CVE List CVE-2026-42084
- GitHub Advisory GHSA-wgx6-g857-jjf7
- NVD CVE-2026-42084
- OSV PYSEC-2026-2242
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.