CVE-2026-103244: ground-station before 0.8.0 Authentication Bypass via setup.restore
ground-station versions before 0.8.0 contain an authentication bypass vulnerability in the setup.restore command that allows unauthenticated attackers to execute arbitrary SQL during first-run setup mode. Attackers can invoke setup.restore via Socket.IO to plant admin users and forged session tokens, then authenticate as administrator without credentials for complete application takeover.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ground-stationto a version that resolves this vulnerability.Fixed in 0.8.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Ground-station versions before 0.8.0 are affected when they are in first-run setup mode. The vulnerable setup.restore command is reachable through Socket.IO.
What does an attacker need to exploit the vulnerability?
An attacker needs network access to the vulnerable Socket.IO service while the application is in first-run setup mode. No credentials or user interaction are required.
What can an attacker do after exploiting it?
An attacker can execute arbitrary SQL, including creating administrator users and forged session tokens. This enables authentication as an administrator and complete application takeover.
How can the issue be remediated?
Upgrade ground-station to version 0.8.0 or later. The vulnerability affects versions before 0.8.0.