CVE-2026-42084

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-42084", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-23T19:17:30.566Z", "datePublished": "2026-05-04T17:11:31.853Z", "dateUpdated": "2026-05-06T13:39:58.104Z"}, "containers": {"cna": {"title": "OpenC3 COSMOS: Hijacked session token can be used to reset password for persistence", "problemTypes": [{"descriptions": [{"cweId": "CWE-620", "lang": "en", "description": "CWE-620: Unverified Password Change", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/OpenC3/cosmos/security/advisories/GHSA-wgx6-g857-jjf7", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/OpenC3/cosmos/security/advisories/GHSA-wgx6-g857-jjf7"}, {"name": "https://github.com/OpenC3/cosmos/commit/2e623714e3426d5ae81b6f8239d4a2a6937ef776", "tags": ["x_refsource_MISC"], "url": "https://github.com/OpenC3/cosmos/commit/2e623714e3426d5ae81b6f8239d4a2a6937ef776"}, {"name": "https://github.com/OpenC3/cosmos/releases/tag/v6.10.5", "tags": ["x_refsource_MISC"], "url": "https://github.com/OpenC3/cosmos/releases/tag/v6.10.5"}, {"name": "https://github.com/OpenC3/cosmos/releases/tag/v7.0.0-rc3", "tags": ["x_refsource_MISC"], "url": "https://github.com/OpenC3/cosmos/releases/tag/v7.0.0-rc3"}], "affected": [{"vendor": "OpenC3", "product": "cosmos", "versions": [{"version": "< 6.10.5", "status": "affected"}, {"version": ">= 7.0.0.pre.rc1, < 7.0.0-rc3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-04T17:11:31.853Z"}, "descriptions": [{"lang": "en", "value": "OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to versions 6.10.5 and 7.0.0-rc3, the OpenC3 password change functionality allows a user to change their password without providing the old password, by accepting a valid session token instead. In assumed breach scenarios, this behaviour can be exploited by an attacker who has already obtained a valid session token, to gain persistence in hijacked account (including admin) and prevent legitimate users from accessing the account. This issue has been patched in versions 6.10.5 and 7.0.0-rc3."}], "source": {"advisory": "GHSA-wgx6-g857-jjf7", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/OpenC3/cosmos/security/advisories/GHSA-wgx6-g857-jjf7", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-06T13:39:31.426814Z", "id": "CVE-2026-42084", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-06T13:39:58.104Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-42084", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-05-06T13:39:31.426814Z"}}}], "references": [{"url": "https://github.com/OpenC3/cosmos/security/advisories/GHSA-wgx6-g857-jjf7", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-06T13:39:49.539Z"}}], "cna": {"title": "OpenC3 COSMOS: Hijacked session token can be used to reset password for persistence", "source": {"advisory": "GHSA-wgx6-g857-jjf7", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "OpenC3", "product": "cosmos", "versions": [{"status": "affected", "version": "< 6.10.5"}, {"status": "affected", "version": ">= 7.0.0.pre.rc1, < 7.0.0-rc3"}]}], "references": [{"url": "https://github.com/OpenC3/cosmos/security/advisories/GHSA-wgx6-g857-jjf7", "name": "https://github.com/OpenC3/cosmos/security/advisories/GHSA-wgx6-g857-jjf7", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/OpenC3/cosmos/commit/2e623714e3426d5ae81b6f8239d4a2a6937ef776", "name": "https://github.com/OpenC3/cosmos/commit/2e623714e3426d5ae81b6f8239d4a2a6937ef776", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/OpenC3/cosmos/releases/tag/v6.10.5", "name": "https://github.com/OpenC3/cosmos/releases/tag/v6.10.5", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/OpenC3/cosmos/releases/tag/v7.0.0-rc3", "name": "https://github.com/OpenC3/cosmos/releases/tag/v7.0.0-rc3", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to versions 6.10.5 and 7.0.0-rc3, the OpenC3 password change functionality allows a user to change their password without providing the old password, by accepting a valid session token instead. In assumed breach scenarios, this behaviour can be exploited by an attacker who has already obtained a valid session token, to gain persistence in hijacked account (including admin) and prevent legitimate users from accessing the account. This issue has been patched in versions 6.10.5 and 7.0.0-rc3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-620", "description": "CWE-620: Unverified Password Change"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-04T17:11:31.853Z"}}}, "cveMetadata": {"cveId": "CVE-2026-42084", "state": "PUBLISHED", "dateUpdated": "2026-05-06T13:39:58.104Z", "dateReserved": "2026-04-23T19:17:30.566Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-04T17:11:31.853Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "cosmos", "vendor": "OpenC3", "versions": [{"status": "affected", "version": "< 6.10.5"}, {"status": "affected", "version": ">= 7.0.0.pre.rc1, < 7.0.0-rc3"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:openc3:cosmos:*:*:*:*:open_source:*:*:*", "matchCriteriaId": "930EEABE-50A2-4005-AE3C-2D14AF5A60BD", "versionEndExcluding": "6.10.5", "vulnerable": true}, {"criteria": "cpe:2.3:a:openc3:cosmos:7.0.0:rc1:*:*:open_source:*:*:*", "matchCriteriaId": "38B72355-49A3-4D2F-BFDB-EE53C9E2C7AD", "vulnerable": true}, {"criteria": "cpe:2.3:a:openc3:cosmos:7.0.0:rc2:*:*:open_source:*:*:*", "matchCriteriaId": "13E3A0EA-1085-4505-80BB-C0B133EC3498", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to versions 6.10.5 and 7.0.0-rc3, the OpenC3 password change functionality allows a user to change their password without providing the old password, by accepting a valid session token instead. In assumed breach scenarios, this behaviour can be exploited by an attacker who has already obtained a valid session token, to gain persistence in hijacked account (including admin) and prevent legitimate users from accessing the account. This issue has been patched in versions 6.10.5 and 7.0.0-rc3."}, {"lang": "es", "value": "OpenC3 COSMOS proporciona la funcionalidad necesaria para enviar comandos a y recibir datos de uno o m\u00e1s sistemas embebidos. Antes de las versiones 6.10.5 y 7.0.0-rc3, la funcionalidad de cambio de contrase\u00f1a de OpenC3 permite a un usuario cambiar su contrase\u00f1a sin proporcionar la contrase\u00f1a antigua, al aceptar un token de sesi\u00f3n v\u00e1lido en su lugar. En escenarios de brecha asumida, este comportamiento puede ser explotado por un atacante que ya ha obtenido un token de sesi\u00f3n v\u00e1lido, para obtener persistencia en una cuenta secuestrada (incluyendo la de administrador) y evitar que usuarios leg\u00edtimos accedan a la cuenta. Este problema ha sido parcheado en las versiones 6.10.5 y 7.0.0-rc3."}], "id": "CVE-2026-42084", "lastModified": "2026-10-26T19:10:00.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42084", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-05-06T13:39:31.426814Z", "version": "2.0.3"}}]}, "published": "2026-05-04T18:16:30.357", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/OpenC3/cosmos/commit/2e623714e3426d5ae81b6f8239d4a2a6937ef776"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/OpenC3/cosmos/releases/tag/v6.10.5"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/OpenC3/cosmos/releases/tag/v7.0.0-rc3"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/OpenC3/cosmos/security/advisories/GHSA-wgx6-g857-jjf7"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/OpenC3/cosmos/security/advisories/GHSA-wgx6-g857-jjf7"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-620"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.10.5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[7.0.0.pre.rc1,7.0.0-rc3)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "cosmos", "source": "cna", "vendor": "OpenC3"}, "product": "cosmos", "vendor": "openc3"}], "created": "2026-05-04T19:00:07.685726+00:00", "updated": "2026-05-04T19:43:53.623246+00:00", "vendors": ["openc3", "openc3$PRODUCT$cosmos"]}