CVE-2026-49447

MediumCVSS 5.3

Published: 28/07/2026(UTC)Updated: 23/10/2026(UTC)Translated: 29/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.38%

31th percentile - higher than 31% of all known CVEs

Summary

Cosmos version 0.22.18 discloses Constellation device metadata to any requester supplying a non-empty Authorization header. The handler strips the 'Bearer ' prefix but never validates the token or uses it in the database query.

Risk Assessment

An unauthenticated attacker can obtain Constellation device metadata, potentially leaking infrastructure information.

Recommendation

Upgrade to version 0.22.19, which contains the fix.

Other vulnerabilities in Cosmos

CVE-2026-49446Medium
In Cosmos prior to 0.22.19, tokenMiddleware in src/proxy/routerGen.go can return through the Constellation tunnel bypass before removing x-cosmos-user, x-cosmos-role, x-cosmos-user-role, and x-cosmos-mfa headers and before invoking AdminOnlyWithRedirect. An attacker with a valid x-cstln-auth API key for an enrolled device who reaches Cosmos through the Constellation Nebula tunnel can supply a chosen x-cosmos-user value to a route with AuthEnabled enabled when the upstream application trusts that forward-auth header.

Original NVD description (English source)

Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. In 0.22.18, `GET /cosmos/api/constellation/public-devices` discloses Constellation device metadata to a requester that supplies any non-empty Authorization header. The handler strips the string Bearer from the header but never validates the resulting token and never uses it in the database query. This vulnerability is fixed in 0.22.19.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS