CVE-2026-49446 Cosmos: Authentication bypass via forward-auth header smuggling on Constellation tunnel in Cosmos-Server
Attackers can bypass authentication and impersonate users or gain admin access by smuggling headers through the Constellation tunnel in Cosmos-Server.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-49446?
CVE-2026-49446 is a medium-severity authentication bypass vulnerability in azukaar Cosmos-Server, published on 15 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Prior to 0.22.19, tokenMiddleware in src/proxy/routerGen.go can return through the Constellation tunnel bypass before removing x-cosmos-user, x-cosmos-role, x-cosmos-user-role, and x-cosmos-mfa headers and before invoking AdminOnlyWithRedirect. An attacker with a valid x-cstln-auth API key for an enrolled device who reaches Cosmos through the Constellation Nebula tunnel can supply a chosen x-cosmos-user value to a route with AuthEnabled enabled when the upstream application trusts that forward-auth header. The request can bypass Cosmos JWT, password, MFA, and AdminOnly checks, allowing user impersonation and admin-tier reads or writes exposed by the proxied application. This issue is fixed in version 0.22.19.
Which versions are affected by CVE-2026-49446?
3 open source packages ship an affected version, including github.com/azukaar/cosmos-server.
| Package | Affected | Fixed in |
|---|---|---|
github.com/azukaar/cosmos-server Go | All versions | 0.22.19 |
github.com/azukaar/cosmos-server Go | All versions | 0.22.19 |
github.com/azukaar/cosmos-server Go | All versions | 0.22.19 |
How do I fix CVE-2026-49446?
Upgrade github.com/azukaar/cosmos-server to 0.22.19 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-49446 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-49446 exists.
Sources
Also known as GHSA-2rx5-2g7j-2659, GO-2026-6123.