Read the docs
TI-2026-38941 Aliases CVE-2026-53984GHSA-g756-f8g3-qffc

Missing authentication in Efstratios Goudelis Ground Station

Priority MEDIUM 45CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

Ground Station prior to 0.6.0 contains an unauthenticated database-destruction and arbitrary-data-injection vulnerability in the Socket.IO server's database_backup event handler that allows any unauthenticated network peer to wipe or replace the entire SQLite database by sending a single full_restore command with a caller-supplied SQL blob. Attackers can connect to the Socket.IO server on port 7000 without credentials due to disabled authentication enforcement and a wildcard CORS policy, then emit the database_backup event to drop every existing table and recreate the database from attacker-controlled CREATE TABLE and INSERT INTO statements executed via raw exec_driver_sql, permanently destroying all satellite records, orbital sources, hardware configurations, and observation schedules, or planting fabricated orbital-source URLs and observation entries that redirect the ground station to attacker-controlled servers on the next scheduled sync.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00726 54th percentileScored 2026-11-07
Fix Fixed Ground Station (Efstratios Goudelis): 0.6.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Efstratios GoudelisGround Stationbefore 0.6.00.6.0Patch availableCNA
  • Ground Station VendorEfstratios Goudelis Affected before 0.6.0 Fixed in 0.6.0 Patch available CNA

Remediation

  • Fix · CNA Ground Station (Efstratios Goudelis) Fixed in 0.6.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Efstratios Goudelis Ground Station — GitHub Security Advisory (GHSA-mjp8-x6h7-229q)

    3 records Highest priority Priority MEDIUM 3 MEDIUM

    Other records, highest priority first

    • TI-2026-38940 Ground Station prior to 0.6.0 Unauthenticated Persistent Blind Server-Side Request Forgery via Orbital Data Source URLPriority MEDIUM 46
    • TI-2026-38942 Ground Station prior to 0.6.0 Unauthenticated DoS via service_control Socket.IOPriority MEDIUM 45
    Show all 3 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-53984
  2. 2026-10-03 Alias added: GHSA-g756-f8g3-qffc

References

Patch 1

Advisory 1

Other 1

  • TI-2026-38940 Ground Station prior to 0.6.0 Unauthenticated Persistent Blind Server-Side Request Forgery via Orbital Data Source URL CVSS 4.0CRITICAL 9.2
  • TI-2026-38942 Ground Station prior to 0.6.0 Unauthenticated DoS via service_control Socket.IO CVSS 4.0HIGH 8.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences