CVE-2026-42087: OpenC3 COSMOS: SQL Injection in QuestDB Time-Series Data Base
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From version 6.7.0 to before version 7.0.0-rc3, a SQL injection vulnerability exists in the Time-Series Database (TSDB) component of COSMOS. The tsdblookup function in the cvtmodel.rb file directly places user-supplied input into a SQL query without sanitizing the input. As a result, a user can break out of the initial SQL statement and execute arbitrary SQL commands, including deleting data. This issue has been patched in version 7.0.0-rc3.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42087?
CVE-2026-42087 is classified as a critical vulnerability due to its potential for SQL injection attacks.
How do I fix CVE-2026-42087?
To fix CVE-2026-42087, upgrade OpenC3 COSMOS to version 7.0.0-rc3 or later.
What systems are affected by CVE-2026-42087?
CVE-2026-42087 affects OpenC3 COSMOS versions 6.7.0 through versions before 7.0.0-rc3.
What is the nature of the vulnerability in CVE-2026-42087?
The vulnerability in CVE-2026-42087 is an SQL injection in the Time-Series Database used by OpenC3 COSMOS.
What impact can CVE-2026-42087 have on your systems?
Successful exploitation of CVE-2026-42087 can allow attackers to execute arbitrary SQL queries, leading to potential data leakage or corruption.