PT-2026-65605 · Cosmos · Cosmos

CVE-2026-49447 · Published 2026-07-28 · Updated 2026-07-28

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cosmos versions prior to 0.22.19

Description Cosmos discloses Constellation device metadata to any requester who provides a non-empty Authorization header. The system fails to validate the token provided in the header, stripping the Bearer string but ignoring the resulting value during database queries and permission checks. This allows an unauthenticated attacker to enumerate sensitive information, including device names, user nicknames, internal and VPN IP addresses, node roles, public hostnames, and ports. This issue affects deployments where the Constellation VPN feature is enabled and contains visible devices.

API Endpoints: GET /cosmos/api/constellation/public-devices Vulnerable Parameters or Variables: Authorization

Recommendations Update to version 0.22.19. As a temporary mitigation, restrict access to the GET /cosmos/api/constellation/public-devices endpoint or disable the Constellation VPN feature if it is not required.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2026-49447

GHSA-5FQM-CC34-FCF5

Affected Products

Cosmos

References · 6

• https://osv.dev/vulnerability/GHSA-5fqm-cc34-fcf5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-49447 · Security Note
• https://github.com/azukaar/Cosmos-Server/commit/59c561d686c8f9843b3e092b50f6346c481d8bbf · Note
• https://github.com/azukaar/Cosmos-Server/security/advisories/GHSA-5fqm-cc34-fcf5 · Note
• https://github.com/azukaar/Cosmos-Server/releases/tag/v0.22.19 · Note
• https://github.com/azukaar/Cosmos-Server · Note