CVE-2026-42084
Description
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to versions 6.10.5 and 7.0.0-rc3, the OpenC3 password change functionality allows a user to change their password without providing the old password, by accepting a valid session token instead. In assumed breach scenarios, this behaviour can be exploited by an attacker who has already obtained a valid session token, to gain persistence in hijacked account (including admin) and prevent legitimate users from accessing the account. This issue has been patched in versions 6.10.5 and 7.0.0-rc3.
How to fix
- openc3 cosmos6.10.5 or later
- openc36.10.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| openc3 cosmos | v < 6.10.5, 7.0.0 | 6.10.5 |
| openc3PyPI | v < 6.10.5 | 6.10.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.