CVE-2026-77602

Name of the Vulnerable Software and Affected Versions OpenC3 COSMOS versions 5.1.0 through 7.3.0

Description Authenticated non-administrator users can achieve arbitrary code execution on a COSMOS server by writing malicious content into the targets modified/ overlay directory. This is possible because the system reads configuration from this user-writable area before the read-only targets/ tree and subsequently executes the content through several paths.

Technical exploitation occurs via three primary sinks:

Attackers can place files in the overlay using the storage-upload endpoint (which exempts targets modified/ from admin checks) or the screen-save endpoint. In the open-source edition, the authorize function ignores permission strings, allowing any authenticated user to exploit these paths.

Recommendations Update OpenC3 COSMOS to version 7.3.0. As a temporary mitigation, restrict access to the storage controller.rb get upload presigned request endpoint and the screens controller.rb create endpoint to administrator users only. Restrict the use of the require function within the Script Runner suite analysis to the script run permission tier.