CVE-2026-42087Disclosure(openc3 / cosmos)

LOWCVSS 9.6 · CRITICAL

Signal is active with 2 mentions in latest observed window

Immediate actions

Patch openc3 cosmos systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From version 6.7.0 to before version 7.0.0-rc3, a SQL injection vulnerability exists in the Time-Series Database (TSDB) component of COSMOS. The tsdb_lookup function in the cvt_model.rb file directly places user-supplied input into a SQL query without sanitizing the input. As a result, a user can break out of the initial SQL statement and execute arbitrary SQL commands, including deleting data. This issue has been patched in version 7.0.0-rc3.

openc3 CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Patch / fix

https://github.com/OpenC3/cosmos/commit/9ba60c09c8836a37a2e4ea67ab35fe403e041415

Exploit / PoC references

Other references

https://github.com/OpenC3/cosmos/releases/tag/v7.0.0-rc3

Weakness type (CWE)

CWE-89

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

cosmos

Threat summary

Patch or workaround signal is available
8 mentions across 4 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 5 signals
Disclosure: 5 classified signals
General: 2 classified signals
Peaked 2d ago at 4 mentions (2026-05-13); latest day: 2
8 total mentions across 4 days

Affected systems

Vendors

openc3

Products

cosmos

1 version affected across 1 product

Deep dive

Activity timeline8 mentions / 4d

Signal classification3 categories

Disclosure

562.5%

General

225.0%

Patch

112.5%

Referenced assets2 URLs

By indicator

Classification over time

Date	Total	Labels

2026-05-04	1	Disclosure1
2026-05-13	4	Disclosure2General2
2026-05-25	1	Patch1
2026-06-03	2	Disclosure2

Full discourse8 posts

Lyrie.ai@lyrie_ai129d
Disclosure
CVE-2026-42087 (SQL Injection): The tsdblookup function in cvtmodel.rb fails to sanitize user input before inserting it into a SQL query against the time-series database. An unauthenticated attacker with network access can inject SQL commands to exfiltrate or delete…
Post summary
The text discloses CVE-2026-42087, a SQL Injection flaw in the tsdblookup function of cvtmodel.rb that allows unauthenticated attackers with network access to inject SQL commands.
1000029
239 followersView on X
Lyrie.ai@lyrie_ai129d
Disclosure
TL;DR OpenC3 COSMOS, the command-and-control platform for industrial SCADA systems, was disclosed on May 4, 2026 with TWO critical vulnerabilities (both CVSS 9.6). CVE-2026-42087 is an unauthenticated SQL injection in the time-series database; CVE-2026-42088 allows…
Post summary
OpenC3 COSMOS platform is announced to have two critical vulnerabilities (CVE‑2026‑42087 and CVE‑2026‑42088), with CVE‑2026‑42087 identified as an unauthenticated SQL injection in its time‑series database.
1000027
239 followersView on X
Lyrie.ai@lyrie_ai150d
General
References CVE: CVE-2026-42087 CVSS: 9.6 (3.1) — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N Severity: CRITICAL Status: Critical advisory
Post summary
The text contains only basic reference information about CVE‐2026‑42087, listing its CVSS score and severity rating, without any additional technical, exploit, or patch details.
1000033
210 followersView on X
Lyrie.ai@lyrie_ai150d
Disclosure
CVE: CVE-2026-42087 CVSS: 9.6 (3.1) — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N Severity: CRITICAL Status: Critical advisory OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems.
Post summary
The notice identifies CVE‑2026‑42087 as a critical vulnerability with a CVSS score of 9.6 and labels it as a critical advisory, but provides no PoC, exploit, or patch information.
1000041
210 followersView on X
Lyrie.ai@lyrie_ai150d
Disclosure
CRITICAL: CVE-2026-42087 (CVSS 9.6) — multiple products. CVE: CVE-2026-42087 CVSS: 9.6 (3.1) — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N Severity: CRITICAL Status: Critical advisory
Post summary
The advisory announces CVE‑2026‑42087 as critical with a CVSS 9.6 score, but offers no PoC, exploit, or patch details.
1000026
210 followersView on X
DFIR Lab@DFIR_Lab138d
Patch
🚨 CRITICAL: CVE-2026-42087 (CVSS 9.6) - SQL injection in OpenC3 COSMOS TSDB component. Versions 6.7.0 to <7.0.0-rc3 affected. Attackers can execute arbitrary SQL commands. Patch to 7.0.0-rc3 immediately. #CVE #PatchNow #CyberSecurity https://t.co/m72le50Z9B
Post summary
The tweet announces a critical SQL injection vulnerability (CVE‑2026‑42087) in OpenC3 COSMOS TSDB, details affected versions and a high CVSS score, and urges immediate patching to 7.0.0‑rc3.
0000053
30 followersView on X
Lyrie.ai@lyrie_ai150d
General
https://lyrie.ai/research/research/cve-2026-42087-advisory #lyrie #cybersecurity #CVE #threatintel #zerodayattack
Post summary
The provided excerpt is simply a link to an advisory with no detailed information, PoC, exploit, or mitigation specifics.
0000024
210 followersView on X
CVE@CVEnew158d
Disclosure
CVE-2026-42087 OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From version 6.7.0 to before version 7.0.0-rc3… https://www.cve.org/CVERecord?id=CVE-2026-42087
Post summary
The text references CVE-2026-42087 tied to OpenC3 COSMOS’s command/response capabilities but provides no further technical detail, exploitation evidence, or remediation information.
00000108
57.4K followersView on X

CPE platform detail3 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

3 of 3 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	openc3	cosmos	-	-	-
App	openc3	cosmos	7.0.0	-	-
App	openc3	cosmos	7.0.0	-	-

Explore more

Back to dashboard openc3 CVEs cosmos vulnerabilities

What researchers are saying

CVE-2026-42087

Lyrie.ai[verified]@lyrie_aiDisclosure

The text discloses CVE-2026-42087, a SQL Injection flaw in the tsdblookup function of cvtmodel.rb that allows unauthenticated attackers with network access to inject SQL commands.

Lyrie.ai[verified]@lyrie_aiDisclosure

OpenC3 COSMOS platform is announced to have two critical vulnerabilities (CVE‑2026‑42087 and CVE‑2026‑42088), with CVE‑2026‑42087 identified as an unauthenticated SQL injection in its time‑series database.

Lyrie.ai[verified]@lyrie_aiGeneral

The text contains only basic reference information about CVE‐2026‑42087, listing its CVSS score and severity rating, without any additional technical, exploit, or patch details.

Lyrie.ai[verified]@lyrie_aiDisclosure

The notice identifies CVE‑2026‑42087 as a critical vulnerability with a CVSS score of 9.6 and labels it as a critical advisory, but provides no PoC, exploit, or patch information.

Lyrie.ai[verified]@lyrie_aiDisclosure

The advisory announces CVE‑2026‑42087 as critical with a CVSS 9.6 score, but offers no PoC, exploit, or patch details.

DFIR Lab[verified]@DFIR_LabPatch

The tweet announces a critical SQL injection vulnerability (CVE‑2026‑42087) in OpenC3 COSMOS TSDB, details affected versions and a high CVSS score, and urges immediate patching to 7.0.0‑rc3.

Lyrie.ai[verified]@lyrie_aiGeneral

The provided excerpt is simply a link to an advisory with no detailed information, PoC, exploit, or mitigation specifics.

CVE@CVEnewDisclosure

The text references CVE-2026-42087 tied to OpenC3 COSMOS’s command/response capabilities but provides no further technical detail, exploitation evidence, or remediation information.