CVE-2026-53984 Missing authorization in Ground Station
Unauthenticated attackers can wipe or inject arbitrary data into the SQLite database via Socket.IO, destroying satellite records or planting malicious entries.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-53984?
CVE-2026-53984 is a high-severity missing authorization vulnerability in Efstratios Goudelis Ground Station, published on 6 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Ground Station prior to 0.6.0 contains an unauthenticated database-destruction and arbitrary-data-injection vulnerability in the Socket.IO server's database_backup event handler that allows any unauthenticated network peer to wipe or replace the entire SQLite database by sending a single full_restore command with a caller-supplied SQL blob. Attackers can connect to the Socket.IO server on port 7000 without credentials due to disabled authentication enforcement and a wildcard CORS policy, then emit the database_backup event to drop every existing table and recreate the database from attacker-controlled CREATE TABLE and INSERT INTO statements executed via raw exec_driver_sql, permanently destroying all satellite records, orbital sources, hardware configurations, and observation schedules, or planting fabricated orbital-source URLs and observation entries that redirect the ground station to attacker-controlled servers on the next scheduled sync.
Weakness: CWE-306
Which versions are affected by CVE-2026-53984?
How do I fix CVE-2026-53984?
No fix has been published for CVE-2026-53984 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-53984 being exploited?
There is no known exploitation of CVE-2026-53984 in the wild and no public exploit code.
Sources
Also known as GHSA-g756-f8g3-qffc.