CVE-2026-42087 is a critical-severity (CVSS 9.6) SQL Injection vulnerability in openc3. A fix is available for openc3 — see the affected versions and patch details below.
OpenC3 COSMOS: SQL Injection in QuestDB Time-Series Data Base
Exploitation Status
Proof-of-concept exploit code exists
- CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
- A successful exploit gives an attacker total control of the affected component, not partial access.
Exploitation and automatability from CISA’s SSVC triage for CVE-2026-42087.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
openc3Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects RubyGems packages — download data is not available via public APIs for these ecosystems.
Description
Vulnerability Type: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Attack type: Authenticated remote Impact: Telemetry data disclosure and deletion Affected components: openc3-tsdb (QuestDB)
A SQL injection vulnerability exists in the Time-Series Database (TSDB) component of COSMOS. The tsdb_lookup function in the cvt_model.rb file directly places user-supplied input into a SQL query without sanitizing the input. As a result, a user can break out of the initial SQL statement and execute arbitrary SQL commands, including deleting data.
Figure 1: Source code vulnerable to SQL injection
Additionally, the get_tlm_values RPC endpoint only requires “tlm” permissions, allowing any user with the Admin, Operator, Viewer, or Runner roles to send a request to the TSDB. This permission is defined in roles-permissions.md to allow for the user to view telemetry data, but this vulnerability also allows them to delete data and tables.
Figure 2: Source code showing the required permissions for the get_tlm_values endpoint
Sending a normal request to the endpoint brings back a single array of values for the parameter:
Figure 3: A normal request to the get_tlm_values endpoint
However, sending a specially crafted request within the start_time variable brings back all the data in the database:
Figure 4: The request and response after sending the SQL injection payload This payload can be modified to executes SQL commands in the TSDB.
<img width="944" height="425" alt="image" src="https://github.com/user-attachments/assets/70c3c88e-9ed6-4542-bfb4-e77abb002c15" />Figure 5: SQL injection used to execute arbitrary SQL command The user can then delete all the historical data in the database:
<img width="944" height="496" alt="image" src="https://github.com/user-attachments/assets/f2dc1fa6-5fe0-4232-867a-a65776f108ee" />Figure 6: Example payload dropping the tables
Steps to Reproduce
- Capture a JSON-RPC request to the
get_tlm_valuesendpoint. - Add the
start_timekey to the request body and place the following in the value:
‘ OR 1=1 --
- Retrieve all database data.
Recommendations
• Sanitize all user-supplied input before executing it • Use prepared statements with parameterized queries when executing SQL statements
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 💎RubyGems | openc3 | ≥ 6.7.0&&< 7.0.0-rc3 | 7.0.0-rc3bundle update openc3 --conservative |
Affected Products
cosmosopenc3Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for openc3, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update openc3 to 7.0.0-rc3 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-42087 is resolved across your whole dependency graph.
Workarounds
Until you can upgrade, make sure every query built from user input uses parameterised statements or a prepared-statement API rather than string concatenation, and reduce the database account's privileges so an injected query cannot read or alter data beyond what the feature needs.
Frequently Asked Questions
Is CVE-2026-42087 in your dependencies?
Find it across RubyGems, including transitive dependencies.