CVE-2026-53983: Ground Station 0 to before 0.6.0

Affected technology

Ground Station · 0 to before 0.6.0
Efstratios Goudelis

Description’s affected range: prior to 0.6.0

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Attackers can connect to the Socket.IO server on port 7000 without credentials due to disabled authentication enforcement and a wildcard CORS policy, then submit a data_submission event with submit-orbital-sources action to persist an attacker-supplied URL in the database, then trigger an orbital sync via the equally unauthenticated background_task:start event. Vendor/CNA’s CVSS 4.0 assessment (base score 9.2/10) rates confidentiality impact as high; integrity and availability impact as none.