PT-2026-36711 · Rubygems · Openc3

Published 2026-04-23 · Updated 2026-04-23

OSV

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Vulnerability Type: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Attack type: Authenticated remote Impact: Telemetry data disclosure and deletion Affected components: openc3-tsdb (QuestDB)

A SQL injection vulnerability exists in the Time-Series Database (TSDB) component of COSMOS. The tsdb lookup function in the cvt model.rb file directly places user-supplied input into a SQL query without sanitizing the input. As a result, a user can break out of the initial SQL statement and execute arbitrary SQL commands, including deleting data.

Figure 1: Source code vulnerable to SQL injection Additionally, the get tlm values RPC endpoint only requires “tlm” permissions, allowing any user with the Admin, Operator, Viewer, or Runner roles to send a request to the TSDB. This permission is defined in roles-permissions.md to allow for the user to view telemetry data, but this vulnerability also allows them to delete data and tables.

Figure 2: Source code showing the required permissions for the get tlm values endpoint Sending a normal request to the endpoint brings back a single array of values for the parameter:

Figure 3: A normal request to the get tlm values endpoint However, sending a specially crafted request within the start time variable brings back all the data in the database:

Figure 4: The request and response after sending the SQL injection payload This payload can be modified to executes SQL commands in the TSDB.

Figure 5: SQL injection used to execute arbitrary SQL command The user can then delete all the historical data in the database:

Figure 6: Example payload dropping the tables

Steps to Reproduce

1. Capture a JSON-RPC request to the get tlm values endpoint.
2. Add the start time key to the request body and place the following in the value:

‘ OR 1=1 --

3. Retrieve all database data.

Recommendations

• Sanitize all user-supplied input before executing it • Use prepared statements with parameterized queries when executing SQL statements

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

GHSA-V529-VHWC-WFC5

Affected Products

Openc3

References · 7

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/openc3/CVE-2026-42087.yml · Exploit
• https://osv.dev/vulnerability/GHSA-v529-vhwc-wfc5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42087 · Security Note
• https://github.com/OpenC3/cosmos · Note
• https://github.com/OpenC3/cosmos/security/advisories/GHSA-v529-vhwc-wfc5 · Note
• https://github.com/OpenC3/cosmos/commit/9ba60c09c8836a37a2e4ea67ab35fe403e041415 · Note
• https://github.com/OpenC3/cosmos/releases/tag/v7.0.0-rc3 · Note