CVE-2026-123485: Ground Station 0.6.0 before 0.8.20 Credential Disclosure via get-orbital-sources
Ground Station from 0.6.0 before 0.8.20 does not restrict the get-orbital-sources Socket.IO handler (also exposed as get-tle-sources) to administrators, although the orbital-source write handlers are admin-only. An authenticated operator-role user can call either handler to retrieve the plaintext usernames, passwords, and tokens that administrators stored for basic and token orbital sources.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ground Stationto a version that resolves this vulnerability.Fixed in 0.8.20
Event History
Frequently Asked Questions
Who can retrieve the stored orbital-source credentials?
Any authenticated user with the operator role can retrieve them. Administrator access is not required.
What credentials are exposed?
The affected handlers return plaintext usernames, passwords, and tokens stored by administrators for basic and token orbital sources.
Which interfaces expose the information?
Both the get-orbital-sources Socket.IO handler and its get-tle-sources alias can be called by an authenticated operator-role user.
Are the orbital-source write operations also accessible to operators?
No. The orbital-source write handlers are restricted to administrators; the access-control issue affects the read handlers.