CVE-2026-49446

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-49446

Import Source

https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-49446.json

JSON Data

https://api.test.osv.dev/v1/vulns/CVE-2026-49446

Aliases

Downstream

Related

Published

2026-09-15T14:31:24Z

Modified

2026-10-15T10:52:42Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N CVSS Calculator

Summary

Cosmos: Authentication bypass via forward-auth header smuggling on Constellation tunnel in Cosmos-Server

Details

Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Prior to 0.22.19, tokenMiddleware in src/proxy/routerGen.go can return through the Constellation tunnel bypass before removing x-cosmos-user, x-cosmos-role, x-cosmos-user-role, and x-cosmos-mfa headers and before invoking AdminOnlyWithRedirect. An attacker with a valid x-cstln-auth API key for an enrolled device who reaches Cosmos through the Constellation Nebula tunnel can supply a chosen x-cosmos-user value to a route with AuthEnabled enabled when the upstream application trusts that forward-auth header. The request can bypass Cosmos JWT, password, MFA, and AdminOnly checks, allowing user impersonation and admin-tier reads or writes exposed by the proxied application. This issue is fixed in version 0.22.19.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-285",
        "CWE-290"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49446.json"
}

References

Affected packages

Git / github.com/azukaar/cosmos-server

Affected ranges

Type

GIT

Repo

https://github.com/azukaar/cosmos-server

Events

Introduced

Fixed

59c561d686c8f9843b3e092b50f6346c481d8bbf

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "0.22.19"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "fixed":  "59c561d686c8f9843b3e092b50f6346c481d8bbf"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "v0.22.19",
            "range":  [
                {
                    "fixed":  "59c561d686c8f9843b3e092b50f6346c481d8bbf"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

v0.*

v0.1.15

v0.1.16

v0.1.17

v0.10.0

v0.10.1

v0.10.1-unstable

v0.10.1-unstable2

v0.10.1-unstable3

v0.10.2

v0.10.3

v0.10.4

v0.10.4-unstable

v0.10.4-unstable2

v0.10.4-unstable3

v0.10.4-unstable4

v0.11.0

v0.11.0-unstable

v0.11.0-unstable2

v0.11.0-unstable3

v0.11.0-unstable4

v0.11.0-unstable5

v0.11.1

v0.11.2

v0.11.3

v0.12.0

v0.12.0-unstable

v0.12.0-unstable10

v0.12.0-unstable11

v0.12.0-unstable12

v0.12.0-unstable13

v0.12.0-unstable14

v0.12.0-unstable15

v0.12.0-unstable16

v0.12.0-unstable17

v0.12.0-unstable18

v0.12.0-unstable19

v0.12.0-unstable2

v0.12.0-unstable20

v0.12.0-unstable21

v0.12.0-unstable22

v0.12.0-unstable23

v0.12.0-unstable24

v0.12.0-unstable25

v0.12.0-unstable26

v0.12.0-unstable27

v0.12.0-unstable28

v0.12.0-unstable29

v0.12.0-unstable3

v0.12.0-unstable30

v0.12.0-unstable31

v0.12.0-unstable32

v0.12.0-unstable33

v0.12.0-unstable34

v0.12.0-unstable35

v0.12.0-unstable36

v0.12.0-unstable37

v0.12.0-unstable38

v0.12.0-unstable39

v0.12.0-unstable4

v0.12.0-unstable40

v0.12.0-unstable41

v0.12.0-unstable42

v0.12.0-unstable43

v0.12.0-unstable44

v0.12.0-unstable45

v0.12.0-unstable46

v0.12.0-unstable47

v0.12.0-unstable48

v0.12.0-unstable49

v0.12.0-unstable5

v0.12.0-unstable50

v0.12.0-unstable51

v0.12.0-unstable6

v0.12.0-unstable7

v0.12.0-unstable8

v0.12.0-unstable9

v0.12.1

v0.12.2

v0.12.3

v0.12.4

v0.12.5

v0.12.6

v0.12.6-unstable

v0.13.0

v0.13.0-unstable0

v0.13.0-unstable1

v0.13.0-unstable10

v0.13.0-unstable11

v0.13.0-unstable2

v0.13.0-unstable3

v0.13.0-unstable4

v0.13.0-unstable5

v0.13.0-unstable6

v0.13.0-unstable7

v0.13.0-unstable8

v0.13.0-unstable9

v0.13.1

v0.13.2

v0.14.0

v0.14.0-unstable1

v0.14.0-unstable10

v0.14.0-unstable11

v0.14.0-unstable12

v0.14.0-unstable13

v0.14.0-unstable15

v0.14.0-unstable16

v0.14.0-unstable17

v0.14.0-unstable18

v0.14.0-unstable19

v0.14.0-unstable2

v0.14.0-unstable20

v0.14.0-unstable21

v0.14.0-unstable22

v0.14.0-unstable3

v0.14.0-unstable4

v0.14.0-unstable5

v0.14.0-unstable6

v0.14.0-unstable7

v0.14.0-unstable8

v0.14.0-unstable9

v0.14.1

v0.14.2

v0.14.3

v0.14.4

v0.15.0

v0.15.0-unstable10

v0.15.0-unstable11

v0.15.0-unstable12

v0.15.0-unstable13

v0.15.0-unstable14

v0.15.0-unstable15

v0.15.0-unstable16

v0.15.0-unstable17

v0.15.0-unstable18

v0.15.0-unstable19

v0.15.0-unstable21

v0.15.0-unstable22

v0.15.0-unstable23

v0.15.0-unstable24

v0.15.0-unstable25

v0.15.0-unstable26

v0.15.0-unstable27

v0.15.0-unstable28

v0.15.0-unstable29

v0.15.0-unstable8

v0.15.0-unstable9

v0.15.1-unstable1

v0.15.1-unstable2

v0.15.1-unstable3

v0.15.4

v0.15.4-unstable1

v0.15.5

v0.15.6

v0.15.7

v0.15.7-unstable1

v0.15.7-unstable2

v0.15.7-unstable3

v0.16.0

v0.16.0-unstable10

v0.16.0-unstable11

v0.16.0-unstable12

v0.16.0-unstable13

v0.16.0-unstable14

v0.16.0-unstable15

v0.16.0-unstable16

v0.16.0-unstable17

v0.16.0-unstable18

v0.16.0-unstable19

v0.16.0-unstable2

v0.16.0-unstable20

v0.16.0-unstable21

v0.16.0-unstable22

v0.16.0-unstable23

v0.16.0-unstable24

v0.16.0-unstable25

v0.16.0-unstable26

v0.16.0-unstable27

v0.16.0-unstable28

v0.16.0-unstable29

v0.16.0-unstable3

v0.16.0-unstable30

v0.16.0-unstable31

v0.16.0-unstable32

v0.16.0-unstable33

v0.16.0-unstable34

v0.16.0-unstable35

v0.16.0-unstable36

v0.16.0-unstable37

v0.16.0-unstable38

v0.16.0-unstable39

v0.16.0-unstable4

v0.16.0-unstable40

v0.16.0-unstable41

v0.16.0-unstable42

v0.16.0-unstable43

v0.16.0-unstable44

v0.16.0-unstable45

v0.16.0-unstable46

v0.16.0-unstable47

v0.16.0-unstable48

v0.16.0-unstable49

v0.16.0-unstable5

v0.16.0-unstable50

v0.16.0-unstable51

v0.16.0-unstable52

v0.16.0-unstable53

v0.16.0-unstable54

v0.16.0-unstable55

v0.16.0-unstable56

v0.16.0-unstable57

v0.16.0-unstable58

v0.16.0-unstable59

v0.16.0-unstable6

v0.16.0-unstable60

v0.16.0-unstable61

v0.16.0-unstable62

v0.16.0-unstable7

v0.16.0-unstable8

v0.16.0-unstable9

v0.16.1

v0.16.1-unstable1

v0.16.1-unstable2

v0.16.2

v0.16.3

v0.16.3-unstable1

v0.16.3-unstable2

v0.17.0

v0.17.0-unstable1

v0.17.0-unstable10

v0.17.0-unstable11

v0.17.0-unstable12

v0.17.0-unstable13

v0.17.0-unstable14

v0.17.0-unstable15

v0.17.0-unstable16

v0.17.0-unstable17

v0.17.0-unstable18

v0.17.0-unstable19

v0.17.0-unstable2

v0.17.0-unstable20

v0.17.0-unstable21

v0.17.0-unstable22

v0.17.0-unstable23

v0.17.0-unstable24

v0.17.0-unstable25

v0.17.0-unstable26

v0.17.0-unstable27

v0.17.0-unstable28

v0.17.0-unstable29

v0.17.0-unstable3

v0.17.0-unstable30

v0.17.0-unstable4

v0.17.0-unstable5

v0.17.0-unstable6

v0.17.0-unstable7

v0.17.0-unstable8

v0.17.0-unstable9

v0.17.1

v0.17.2

v0.17.3

v0.17.4

v0.17.5

v0.17.6

v0.17.7

v0.18.0

v0.18.0-unstable1

v0.18.0-unstable10

v0.18.0-unstable2

v0.18.0-unstable3

v0.18.0-unstable4

v0.18.0-unstable7

v0.18.0-unstable8

v0.18.0-unstable9

v0.18.0-unstable90

v0.18.0-unstable92

v0.18.0-unstable93

v0.18.0-unstable94

v0.18.0-unstable95

v0.18.0-unstable96

v0.18.0-unstable97

v0.18.0-unstable98

v0.18.0-unstable99

v0.18.0-unstable991

v0.18.1

v0.18.2

v0.18.3

v0.18.4

v0.19.0

v0.19.0-unstable1

v0.19.0-unstable10

v0.19.0-unstable2

v0.19.0-unstable3

v0.19.0-unstable4

v0.19.0-unstable6

v0.19.0-unstable7

v0.19.0-unstable8

v0.19.0-unstable9

v0.19.0-unstable91

v0.19.0-unstable92

v0.19.1

v0.2.0

v0.20.0

v0.20.0-unstable1

v0.20.0-unstable2

v0.20.0-unstable3

v0.20.0-unstable4

v0.20.0-unstable5

v0.20.1

v0.20.1-unstable1

v0.20.2

v0.21.0

v0.21.0-unstable2

v0.21.0-unstable3

v0.21.0-unstable4

v0.21.0-unstable5

v0.21.0-unstable6

v0.21.0-unstable7

v0.21.0-unstable8

v0.21.0-unstable9

v0.21.0-unstable91

v0.21.0-unstable92

v0.21.0-unstable93

v0.21.0-unstable94

v0.21.0-unstable95

v0.21.0-unstable96

v0.21.1

v0.21.2

v0.21.3

v0.21.4

v0.21.5

v0.21.6

v0.21.7

v0.22.0

v0.22.0-unstable01

v0.22.0-unstable03

v0.22.0-unstable04

v0.22.0-unstable06

v0.22.0-unstable07

v0.22.0-unstable08

v0.22.0-unstable09

v0.22.0-unstable10

v0.22.0-unstable11

v0.22.0-unstable12

v0.22.0-unstable13

v0.22.0-unstable14

v0.22.0-unstable15

v0.22.1

v0.22.10

v0.22.11

v0.22.12

v0.22.13

v0.22.14

v0.22.15

v0.22.16

v0.22.18

v0.22.2

v0.22.3

v0.22.4

v0.22.5

v0.22.6

v0.22.7

v0.22.8

v0.22.9

v0.3.0-unstable

v0.3.0-unstable4

v0.3.1

v0.3.2

v0.3.3

v0.3.4

v0.3.5

v0.4.0

v0.4.0-unstable

v0.4.0-unstable10

v0.4.0-unstable11

v0.4.0-unstable12

v0.4.0-unstable2

v0.4.0-unstable3

v0.4.0-unstable4

v0.4.0-unstable5

v0.4.0-unstable6

v0.4.0-unstable7

v0.4.0-unstable8

v0.4.0-unstable9

v0.4.1

v0.4.2

v0.4.3

v0.5.0

v0.5.0-unstable

v0.5.0-unstable10

v0.5.0-unstable11

v0.5.0-unstable12

v0.5.0-unstable13

v0.5.0-unstable14

v0.5.0-unstable15

v0.5.0-unstable16

v0.5.0-unstable17

v0.5.0-unstable18

v0.5.0-unstable19

v0.5.0-unstable2

v0.5.0-unstable20

v0.5.0-unstable21

v0.5.0-unstable22

v0.5.0-unstable23

v0.5.0-unstable24

v0.5.0-unstable25

v0.5.0-unstable26

v0.5.0-unstable27

v0.5.0-unstable28

v0.5.0-unstable29

v0.5.0-unstable3

v0.5.0-unstable30

v0.5.0-unstable4

v0.5.0-unstable5

v0.5.0-unstable6

v0.5.0-unstable7

v0.5.0-unstable8

v0.5.0-unstable9

v0.5.1

v0.5.12

v0.5.2

v0.5.3

v0.5.4

v0.5.5

v0.5.6

v0.5.7

v0.5.7-unstable

v0.5.8

v0.5.9

v0.6.0

v0.6.0-unstable

v0.6.0-unstable2

v0.6.1

v0.6.2

v0.6.3

v0.6.4

v0.6.4-unstable

v0.7.0

v0.7.0-unstable

v0.7.0-unstable2

v0.7.0-unstable3

v0.7.1

v0.7.10

v0.7.2

v0.7.3

v0.7.4

v0.7.5

v0.7.6

v0.7.7

v0.7.8

v0.7.9

v0.8.0

v0.8.0-unstable

v0.8.0-unstable10

v0.8.0-unstable11

v0.8.0-unstable12

v0.8.0-unstable2

v0.8.0-unstable3

v0.8.0-unstable4

v0.8.0-unstable5

v0.8.0-unstable7

v0.8.0-unstable8

v0.8.0-unstable9

v0.8.1

v0.8.10

v0.8.11

v0.8.2

v0.8.3

v0.8.4

v0.8.5

v0.8.6

v0.8.7

v0.8.8

v0.8.9

v0.9.0

v0.9.0-unstable

v0.9.0-unstable10

v0.9.0-unstable11

v0.9.0-unstable12

v0.9.0-unstable13

v0.9.0-unstable2

v0.9.0-unstable3

v0.9.0-unstable4

v0.9.0-unstable5

v0.9.0-unstable6

v0.9.0-unstable7

v0.9.0-unstable8

v0.9.0-unstable9

v0.9.1

v0.9.10

v0.9.11

v0.9.12

v0.9.13

v0.9.14

v0.9.15

v0.9.16

v0.9.17

v0.9.18

v0.9.19

v0.9.19-unstable

v0.9.2

v0.9.20

v0.9.21

v0.9.3

v0.9.4

v0.9.5

v0.9.6

v0.9.7

v0.9.8

v0.9.9

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-49446.json"