Ecosystem	Package	Version

Vulnerabilities

CVE-2025-28388

CVE-2025-28388

OpenC3 COSMOS before v6.0.2 was discovered to contain hardcoded credentials for the Service Account.

Published Oct 28, 2025

https://github.com/CVEProject/cvelistV5/blob/main/cves/2025/28xxx/CVE-2025-28388.json https://visionspace.com/openc3-cosmos-a-security-assessment-of-an-open-source-mission-framework/

CVSS ScoreCritical

9.2

Ecosystem	Package	Version


gem	cosmos	5.0.2.pre.beta2
gem	cosmos	5.0.2
gem	cosmos	5.0.3
gem	cosmos	5.0.4
gem	cosmos	5.0.5
gem	openc3	5.0.10
gem	openc3	5.0.11
gem	openc3	5.0.6
gem	openc3	5.0.7
gem	openc3	5.0.8
gem	openc3	5.0.9
gem	openc3	5.1.0
gem	openc3	5.1.1
gem	openc3	5.10.0
gem	openc3	5.10.1
gem	openc3	5.11.0
gem	openc3	5.11.1
gem	openc3	5.11.2
gem	openc3	5.11.3
gem	openc3	5.12.0
gem	openc3	5.13.0
gem	openc3	5.14.0
gem	openc3	5.14.1
gem	openc3	5.14.2
gem	openc3	5.15.0
gem	openc3	5.15.1
gem	openc3	5.15.2
gem	openc3	5.16.0
gem	openc3	5.16.1
gem	openc3	5.16.2
gem	openc3	5.17.0
gem	openc3	5.17.1
gem	openc3	5.18.0
gem	openc3	5.19.0
gem	openc3	5.2.0
gem	openc3	5.20.0
gem	openc3	5.3.0
gem	openc3	5.4.0
gem	openc3	5.4.1
gem	openc3	5.4.2
gem	openc3	5.4.3.pre.beta0
gem	openc3	5.5.0.pre.beta0
gem	openc3	5.5.0
gem	openc3	5.5.1
gem	openc3	5.5.2.pre.beta0
gem	openc3	5.5.2
gem	openc3	5.6.0
gem	openc3	5.6.1
gem	openc3	5.7.0
gem	openc3	5.7.2

CVE-2025-28388 | Components Impacted | Sonatype Guide | Sonatype Guide