CVE-2026-71460

/api/v2/config/ is protected only by IsAuthenticated. licenseinfo accountnumber, subscriptionid, poolid, sku, supportlevel, instance counts returned to any authenticated user. The superuser/auditor gate only covers projectbasedir/projectlocalpaths/customvirtualenvs, not licenseinfo. Enables socia...

CVE-2026-71461

HostList.list catches bare Exception and returns stre verbatim. Via hostfilter, any authenticated user triggers Django FieldError leaking complete Host model relation graph including internal reverse accessors or PostgreSQL DataError leaking raw database error strings. Two primitives:...

CVE-2026-55632

GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal pipeline structure API used for autocompletion while editing pipeline, template, environment, and user-preference configuration returns its users-and-roles mode to regular authenticated users without requiring an...

CVE-2026-52744

GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal GoCD UI fetch-artifact auto-suggestion API at /go/api/internal/pipelines//upstream does not adequately authorize access to upstream dependency data. An authenticated user can retrieve inter-pipeline dependency hierarchy...

CVE-2026-84707

A flaw was found in Red Hat Ansible Automation Platform's automation-controller. The hostfilter query parameter on the hosts list API is parsed into a raw Django ORM filter whose lookup path is validated only against a sensitive-field blocklist, with no authorization check on the database relatio...

CVE-2026-84709

A flaw was found in Red Hat Ansible Automation Platform's automation-controller. When a custom credential type is created or updated, the injector configuration is validated by rendering each attacker-supplied Jinja2 template synchronously inside the web request worker, with no limit on iteration...

CVE-2026-84703

A flaw was found in Red Hat Ansible Automation Platform's automation-controller. When creating or editing an execution environment, the controller does not verify that the requesting user has use permission on the container registry credential referenced by the execution environment; it validates...

OpenC3 COSMOS: Authenticated remote code execution via the user-writable config overlay (table definitions, cmd/tlm definitions, and script suites)

Summary COSMOS reads configuration from a user-writable overlay targetsmodified/ before the read-only plugin-installed targets/ tree, and the config subsystem executes code on those files: ConfigParser renders every file as ERB by default, a GENERICREADCONVERSION / GENERICWRITECONVERSION block is...

GHSA-JJQ7-M736-W977 OpenC3 COSMOS: Authenticated remote code execution via the user-writable config overlay (table definitions, cmd/tlm definitions, and script suites)

Summary COSMOS reads configuration from a user-writable overlay targetsmodified/ before the read-only plugin-installed targets/ tree, and the config subsystem executes code on those files: ConfigParser renders every file as ERB by default, a GENERICREADCONVERSION / GENERICWRITECONVERSION block is...

CVE-2026-77602 OpenC3 COSMOS: Authenticated remote code execution via the user-writable config overlay (table definitions, cmd/tlm definitions, and script suites)

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.1.0 until 7.3.0, authenticated non-administrator users can write content under targetsmodified/ that is later executed by multiple configuration paths below the intended...

EUVD-2026-85566

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.1.0 until 7.3.0, authenticated non-administrator users can write content under targetsmodified/ that is later executed by multiple configuration paths below the intended...

CVE-2026-77602

OpenC3 COSMOS versions 5.1.0 through 7.3.0 are vulnerable to authenticated remote code execution (RCE) . The root cause is that the system processes a user-writable configuration overlay (targets_modified/) before the read-only targets/ tree. Authenticated non-administrator users can use features...

CVE-2026-77602 OpenC3 COSMOS: Authenticated remote code execution via the user-writable config overlay (table definitions, cmd/tlm definitions, and script suites)

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.1.0 until 7.3.0, authenticated non-administrator users can write content under targetsmodified/ that is later executed by multiple configuration paths below the intended...

EUVD-2026-85564

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.0.6 until 7.3.0, an authenticated actor with systemset permission can store a shared screen through POST /openc3-api/screen whose BUTTON widget action is evaluated by...

CVE-2026-77394

OpenC3 COSMOS versions 5.0.6 through 7.3.0 are vulnerable to a stored, cross-user XSS via the Telemetry screen BUTTON widget. An authenticated actor with system_set permissions can store a screen via POST /openc3-api/screen containing a button action. The application fails to sanitize this input,...

CVE-2026-84689

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The bulk job launch endpoint builds workflow job nodes from client input using a serializer that leaves the node's job reference -- a field normally set by the workflow task manager after it spawns a child job --...

OpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` setting

Summary An authenticated user can execute arbitrary operating system commands on the openc3-cosmos-cmd-tlm-api service. The pypiurl setting is interpolated, unescaped, into a command line that is run through a shell backtick when a plugin is installed. Shell metacharacters in the setting value ar...

GHSA-VP3W-52V9-Q57F OpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` setting

Summary An authenticated user can execute arbitrary operating system commands on the openc3-cosmos-cmd-tlm-api service. The pypiurl setting is interpolated, unescaped, into a command line that is run through a shell backtick when a plugin is installed. Shell metacharacters in the setting value ar...

CVE-2026-77601

OpenC3 COSMOS versions 5.12.0 through 7.3.0 are vulnerable to authenticated OS command injection via the pypi_url setting. An attacker can use the set_setting API method (POST /openc3-api/api) to write a malicious URL containing shell metacharacters. When a plugin with Python dependencies is inst...

EUVD-2026-85563

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.12.0 until 7.3.0, an authenticated actor can write the pypiurl setting through setsetting at POST /openc3-api/api, then cause OpenC3::PluginModel.installphase2 in...