A defect in the Script Runner widget of OpenC3 COSMOS lets any user that can create and execute scripts bypass the normal API permission checks. By running a carefully crafted Python or Ruby script from the openc3-COSMOS-script-runner-api container, the attacker can perform actions that are normally reserved for administrators, such as reading and modifying the Redis database, accessing and altering files in the buckets service, and changing COSMOS configuration secrets. This represents a failure of authorization enforcement (CWE-250) and enables unauthorized privilege escalation.

The vulnerability applies to OpenC3 COSMOS deployments that use the script‑runner‑api container and are running any version prior to 7.0.0-rc3. Only users with script‑creation privileges can exploit it, but because all Docker containers share a network, the attacker can reach internal services like Redis and the bucket storage from the compromised script runner.

With a CVSS score of 9.6 the flaw is considered critical. Although no EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, the lack of those metrics does not diminish the inherent danger. The attack requires only the ability to run scripts; the malicious script can then communicate over the Docker network to access sensitive services, read secrets, and alter system configuration. The vulnerability is therefore readily exploitable in a typical user environment where script execution is enabled.