Description

Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Prior to 0.22.19, tokenMiddleware in src/proxy/routerGen.go can return through the Constellation tunnel bypass before removing x-cosmos-user, x-cosmos-role, x-cosmos-user-role, and x-cosmos-mfa headers and before invoking AdminOnlyWithRedirect. An attacker with a valid x-cstln-auth API key for an enrolled device who reaches Cosmos through the Constellation Nebula tunnel can supply a chosen x-cosmos-user value to a route with AuthEnabled enabled when the upstream application trusts that forward-auth header. The request can bypass Cosmos JWT, password, MFA, and AdminOnly checks, allowing user impersonation and admin-tier reads or writes exposed by the proxied application. This issue is fixed in version 0.22.19.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-09-15T15:17:16.747Z",
  "pubdate": "2026-09-15T15:17:16.747Z",
  "executiveSummary": "A critical header injection and authentication bypass vulnerability exists in Cosmos prior to version 0.22.19. The vulnerability resides within the tokenMiddleware function in src/proxy/routerGen.go, where improper request handling allows authenticated Constellation tunnel users to spoof internal headers. By manipulating x-cosmos-user, x-cosmos-role, and related headers, an attacker can bypass JWT, password, and MFA authentication mechanisms.\nThis vulnerability effectively permits unauthorized user impersonation and unauthorized access to administrative functions within applications proxied by Cosmos. The risk is significant as it undermines the primary security gateway functionality of the product. Successful exploitation requires an attacker to possess a valid x-cstln-auth API key for an enrolled device and network access to the Constellation Nebula tunnel. This flaw allows attackers to achieve privilege escalation, performing actions with administrative read or write permissions on upstream applications that rely on these forwarded headers for identity verification.",
  "technicalDetails": "The root cause of this vulnerability is an improper execution flow within the tokenMiddleware function located in src/proxy/routerGen.go. In affected versions, the middleware fails to sanitize and remove sensitive internal headers—specifically x-cosmos-user, x-cosmos-role, x-cosmos-user-role, and x-cosmos-mfa—before processing requests arriving through the Constellation tunnel.\nThe authentication bypass occurs because the request lifecycle allows the tunnel-originated traffic to bypass the standard security chain, including AdminOnlyWithRedirect checks and JWT verification. Because these security headers are not stripped, an attacker reaching the proxy via an authorized Constellation Nebula connection can inject arbitrary values into the identity headers. If the upstream application is configured to trust these forward-auth headers for authentication, it will accept the attacker's supplied identity as legitimate.\nThe attack flow proceeds as follows: First, an attacker must possess a valid x-cstln-auth API key associated with an enrolled device. Second, the attacker establishes a connection to the Cosmos instance through the Constellation Nebula tunnel. Third, the attacker crafts a malicious HTTP request targeting a route with AuthEnabled set to true. Within this request, the attacker specifies their own values for the x-cosmos-user and associated headers. Finally, because the tokenMiddleware fails to sanitize these headers before the request reaches the upstream application, the proxy forwards the spoofed identity information.\nThis exploitation technique effectively blinds the upstream application to the fact that the request originated from an unauthorized source or that the user has not undergone proper MFA or password validation through Cosmos. The impact includes full user impersonation and unauthorized access to protected endpoints. This vulnerability bypasses all standard gateway-level security controls, leading to a complete compromise of administrative-tier functions exposed by the proxied application. The flaw is specifically present in all versions prior to 0.22.19 and is effectively remediated by the structural logic changes implemented in that version, which ensure headers are stripped prior to tunnel-based request processing."
}