CVE-2025-28381

A credential leak in OpenC3 COSMOS before v6.0.2 allows attackers to access service credentials as environment variables stored in all containers.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
mitreCNA
---
---
CISA-ADPADP
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 24%
VendorProductVersion
openc3cosmos
6.0.0
openc3cosmos
6.0.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/OpenC3/cosmos/pull/1816
https://github.com/OpenC3/cosmos/pull/1816/commits/cce64c213fd2e6a70e2ccbf3622949fe8f9dcaef
https://github.com/OpenC3/cosmos/releases/tag/v6.0.2
https://openc3.com/
https://visionspace.com/openc3-cosmos-a-security-assessment-of-an-open-source-mission-framework/