CVE-2026-49447 azukaar CVE debrief

Who should care

Defenders of Cosmos Server deployments should assess exposure and verify the fix. Affected operators, platforms, vulnerability-management, and security teams should review the vulnerability and take necessary actions. This includes verifying token validation for /cosmos/api/constellation/public-devices and updating to Cosmos Server 0.22.19 if vulnerable.

Why it matters

CVE-2026-49447 allows unauthorized disclosure of device metadata in Cosmos Server 0.22.18. Defenders should assess exposure, verify fixes, and update vulnerable systems.

• Potential exposure of Constellation device metadata
• Need to verify token validation for /cosmos/api/constellation/public-devices
• Update priority for Cosmos Server 0.22.18 users

Technical summary

CVE-2026-49447 is a vulnerability in Cosmos Server version 0.22.18. An unauthenticated GET request to /cosmos/api/constellation/public-devices with a non-empty Authorization header can disclose Constellation device metadata. The vulnerability is due to improper handling of the Authorization header, stripping only the string 'Bearer ' without validating the resulting token. This issue has been fixed in version 0.22.19.

Defensive priority

Assess exposure, verify token validation, and update to 0.22.19 if vulnerable.

Recommended defensive actions

• Assess exposure to CVE-2026-49447 in your deployment
• Verify token validation for /cosmos/api/constellation/public-devices
• Update to Cosmos Server 0.22.19 if vulnerable
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

Official CVE and NVD records confirm the vulnerability in Cosmos Server 0.22.18. Limited details on exploitation. The CVE record was published on 2026-07-28T21:17:28.427Z and has not been modified since then. The vulnerability is due to improper handling of the Authorization header. The handler strips the string Bearer from the header but never validates the resulting token and never uses it in the database query.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.