CVE-2026-42088 — AI Deep Analysis Summary

🚨 **Essence**: OpenC3 COSMOS Script Runner allows users to run Python/Ruby scripts. 🌐 **Consequence**: Scripts bypass API checks to access the shared Docker network.…

🛡️ **CWE**: CWE-250 (Execution of Code with unnecessary privileges). 🔍 **Flaw**: Lack of network isolation between the Script Runner container and other services (Redis, Buckets).…

📦 **Vendor**: OpenC3. 📦 **Product**: COSMOS. 📉 **Affected**: Versions **before 7.0.0-rc3**. ✅ **Fixed**: In v7.0.0-rc3 and later.

🕵️ **Privileges**: Escalates from standard user to Admin-level access.…

🔑 **Auth Required**: Yes. PR:L (Privileges Required: Low). 🚫 **UI**: None required. ⚠️ **Threshold**: Any user with permission to **create and run scripts** can exploit this. No complex config needed.

📜 **Public Exp?**: No specific PoC provided in data. 🌍 **Wild Exploitation**: Low risk currently. 📝 **Note**: References point to GitHub release/advisory, but no active exploit code is listed in the provided data.

🔍 **Check**: Look for OpenC3 COSMOS versions < 7.0.0-rc3. 🧪 **Test**: If you have script execution rights, check if you can reach Redis/Bucket services via the script runner container network.…

🔧 **Fixed**: Yes. 📅 **Patch Date**: Released 2026-05-04. 🚀 **Action**: Upgrade to **v7.0.0-rc3** or **v7.0.0**. 🔗 **Ref**: [GitHub Release](https://github.com/OpenC3/cosmos/releases/tag/v7.0.0-rc3).

🛑 **Workaround**: Restrict script execution permissions to Admins only. 🚫 **Network**: Isolate the Script Runner container from Redis/Bucket networks if possible.…

⚡ **Priority**: HIGH. 📈 **CVSS**: 8.6 (High). 📉 **Vector**: AV:N/AC:L/PR:L/S:C/C:H/I:H/A:N. 🚨 **Reason**: Low attack complexity, low privilege requirement, and high impact on confidentiality/integrity. Fix immediately.