CVE-2026-72577
CriticalCVSS 9.8Summary
NASA fprime-gds through 3.4.3 has multiple vulnerabilities that allow an unauthenticated remote attacker to achieve arbitrary code execution on the ground station host and inject arbitrary commands to connected spacecraft. The Flask application applies no authentication to any endpoint.
Risk Assessment
An attacker can take control of the ground station and influence spacecraft operations, posing a serious threat to space missions.
Recommendation
Enable authentication for all endpoints and update fprime-gds to a patched version.
Original NVD description (English source)
Multiple vulnerabilities in NASA fprime-gds through 3.4.3 allow an unauthenticated remote attacker to achieve arbitrary code execution on the ground station host and inject arbitrary commands to connected spacecraft. The Flask application in src/fprime_gds/flask/app.py applies no authentication to any endpoint.