CVE-2026-79954 NASA CryptoLib 1.5.0 - TC receive path accepts Security Associations from the wrong GVCID
Attackers can bypass authentication in the Telecommand receive path by using Security Associations not authorized for the specific GVCID.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-79954?
CVE-2026-79954 is a high-severity authentication bypass vulnerability in NASA CryptoLib, published on 18 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
NASA CryptoLib 1.5.0 contains an authentication downgrade vulnerability in the Telecommand (TC) receive path. The receiver selects the Security Association used for SDLS processing solely from the SPI field inside the incoming frame, but it does not verify that the selected SA is authorized for the frame's GVCID.
Weakness: CWE-306
Which versions are affected by CVE-2026-79954?
How do I fix CVE-2026-79954?
No fix has been published for CVE-2026-79954 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-79954 being exploited?
There is no known exploitation of CVE-2026-79954 in the wild and no public exploit code.
Sources
Also known as GHSA-64r5-qp28-crvm.