9.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-77602

CVE-2026-77602: OpenC3 COSMOS: Authenticated remote code execution via the user-writable config overlay (table definitions, cmd/tlm definitions, and script suites)

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.1.0 until 7.3.0, authenticated non-administrator users can write content under targets_modified/ that is later executed by multiple configuration paths below the intended code-execution privilege tier. Table and command or telemetry definitions are processed through ConfigParser, PacketConfig, GENERIC_READ_CONVERSION, or GENERIC_WRITE_CONVERSION, allowing ERB rendering or Ruby and Python evaluation, while openc3-cosmos-script-runner-api/scripts/run_suite_analysis.rb executes suite procedure files through require. Storage uploads, screen saves, and script creation can place content in the overlay, and triggering table processing, a cmd/tlm reload, or suite analysis executes the content in cmd-tlm-api, decom microservices, or Script Runner with access to internal credentials and data. This issue is fixed in version 7.3.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-77602

CVE-2026-77602:

9.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
openc3	rubygems	>= 5.1.0, <= 7.2.1	7.3.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a remote code execution flaw in OpenC3 COSMOS, identified as CVE-2026-77602. The root cause is that the system reads configuration from a user-writable directory (targets_modified/) before the read-only system directory (targets/). This allows an authenticated but non-admin user to upload malicious configuration files that are then executed by the server. The analysis of the provided patches confirms this and identifies several vulnerable functions that contribute to the exploit chain.

The primary vulnerable function is OpenC3::Utilities::TargetFile.body (and its Python equivalent), which is responsible for reading files from the overlay directory. Several other functions in different controllers and models use this function to read configuration, scripts, or table definitions, which then get executed. The patches address the vulnerability by modifying these functions to either enforce stricter authorization checks or to force reading from the read-only directory for sensitive operations.

The identified vulnerable functions are entry points for attackers to either write malicious files to the system or to trigger the execution of already uploaded files. These functions would appear in a runtime profile during the exploitation of this vulnerability.

Vulnerable functions

OpenC3::Utilities::TargetFile.body

openc3/lib/openc3/utilities/target_file.rb

This function is the root cause of the vulnerability. It reads configuration files and prioritizes the user-writable `targets_modified/` directory over the read-only `targets/` directory. This allows an attacker to upload a malicious configuration file that will be executed by other parts of the system.

openc3.utilities.target_file.TargetFile.body

openc3/python/openc3/utilities/target_file.py

This is the Python equivalent of the vulnerable `TargetFile.body` function in Ruby. It reads configuration files and prioritizes the user-writable `targets_modified/` directory, leading to the execution of user-provided code.

OpenC3::Table.get_definitions

openc3-cosmos-cmd-tlm-api/app/models/table.rb

This function is responsible for getting table definitions. It was using the vulnerable `TargetFile.body` function to read the definition files. An attacker could upload a malicious table definition to the `targets_modified/` directory, which would then be executed by the `TableConfig` processor.

StorageController.get_upload_presigned_request

openc3-cosmos-cmd-tlm-api/app/controllers/storage_controller.rb

This function provides a presigned URL for file uploads. The vulnerability lies in the insufficient authorization checks, which allowed authenticated non-admin users to upload files to the `targets_modified/` directory. This was one of the entry points for an attacker to place a malicious file on the system.

ScriptsController.body

openc3-cosmos-script-runner-api/app/controllers/scripts_controller.rb

This function retrieves the body of a script. If the script is a suite, it would process it, which involves executing the script. The vulnerability is that this action was not properly authorized, allowing a user with `script_view` permissions to execute arbitrary code.

ScriptsController.create

openc3-cosmos-script-runner-api/app/controllers/scripts_controller.rb

This function creates a new script. If the script is a suite, it would be processed, leading to code execution. The vulnerability is that this action was not properly authorized, allowing a user with `script_edit` permissions to execute arbitrary code.

RunningScriptController.show

openc3-cosmos-script-runner-api/app/controllers/running_script_controller.rb

This function shows the status of a running script. If the running script is a suite, it would be processed, leading to code execution. The vulnerability is that this action was not properly authorized, allowing a user with `script_view` permissions to execute arbitrary code.

TablesController.generate

openc3-cosmos-cmd-tlm-api/app/controllers/tables_controller.rb

This function generates a table and writes it to the `targets_modified` directory. The vulnerability is that it could be used to write to the sensitive `cmd_tlm` subdirectory, which is later executed, without requiring admin privileges.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.