CVE-2026-72577
CriticalCVSS 9.8Summary
Multiple vulnerabilities in NASA fprime-gds through 3.4.3 allow an unauthenticated remote attacker to achieve arbitrary code execution on the ground station host and inject arbitrary commands to connected spacecraft. The Flask application applies no authentication to any endpoint. A path traversal allows reading and writing arbitrary files outside the upload directory. A hardcoded secret key enables session forgery. Chained together, these vulnerabilities allow complete compromise of the ground data system and any spacecraft under its control.
Risk Assessment
The organization may lose control of the ground station system and space mission, potentially leading to catastrophic consequences including data loss, mission security breaches, and potential takeover of spacecraft.
Recommendation
Immediately update fprime-gds to a patched version, implement authentication on all endpoints, remove the hardcoded secret key, and secure file paths against path traversal.
Original NVD description (English source)
Multiple vulnerabilities in NASA fprime-gds through 3.4.3 allow an unauthenticated remote attacker to achieve arbitrary code execution on the ground station host and inject arbitrary commands to connected spacecraft. The Flask application in src/fprime_gds/flask/app.py applies no authentication to any endpoint. A path traversal in src/fprime_gds/flask/updown.py allows reading and writing arbitrary files outside the upload directory. A hardcoded secret key (CWE-321) in the application enables session forgery. Chained together, these vulnerabilities allow complete compromise of the ground data system and any spacecraft under its control.