CVE-2026-49446
Summary
The Constellation-tunnel bypass branch in tokenMiddleware at src/proxy/routerGen.go:53-66 returns to the upstream handler before the request's x-cosmos-user, x-cosmos-role, x-cosmos-user-role, and x-cosmos-mfa headers are stripped at lines 68-72, and before the AdminOnlyWithRedirect gate at lines 109-117 runs. Any holder of a valid Constellation device API key sends x-cosmos-user: admin to a proxied backend; the documented forward-auth integration treats the caller as admin with no JWT cookie, password, or MFA.
Preconditions
- Cosmos is deployed with Constellation enabled and at least one device enrolled.
- Attacker holds a valid x-cstln-auth API key for an enrolled device.
- Attacker reaches Cosmos over the Constellation Nebula tunnel.
- Target proxy route has AuthEnabled=true; upstream trusts the x-cosmos-user forward-auth header.
Details
// src/proxy/routerGen.go:46-122 - bypass returns before headers are reset
func tokenMiddleware(route utils.ProxyRouteConfig) func(next http.Handler) http.Handler {
return func(next http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
enabled := route.AuthEnabled
adminOnly := route.AdminOnly
// bypass auth if from Constellation tunnel
if ((enabled && r.Header.Get("x-cosmos-user") != "") || !enabled) { // attacker-set header opens the branch
remoteAddr, _ := utils.SplitIP(r.RemoteAddr)
isConstIP := constellation.IsConstellationIP(remoteAddr)
isConstTokenValid := constellation.CheckConstellationToken(r) == nil
if isConstIP && isConstTokenValid {
utils.Debug("Bypassing auth for Constellation tunnel")
r.Header.Del("x-cstln-auth")
next.ServeHTTP(w, r) // forwards x-cosmos-user as set by attacker
return
}
}
r.Header.Del("x-cosmos-user") // only runs on the fall-through path
r.Header.Del("x-cosmos-role")
r.Header.Del("x-cosmos-user-role")
r.Header.Del("x-cosmos-mfa")
r.Header.Del("x-cstln-auth")
// ... JWT path runs here ...
if enabled && adminOnly {
if errT := AdminOnlyWit
⚡ Watch CVE-2026-49446
Get an email if CVE-2026-49446 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Advisory coverage (1)
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-49446)