CVE-2026-72577: NASA fprime-gds - Missing Authentication and Path Traversal Enable Unauthenticated RCE and Spacecraft Command Injection
Multiple vulnerabilities in NASA fprime-gds through 3.4.3 allow an unauthenticated remote attacker to achieve arbitrary code execution on the ground station host and inject arbitrary commands to connected spacecraft. The Flask application in src/fprimegds/flask/app.py applies no authentication to any endpoint.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Configure the Flask application in src/fprime_gds/flask/app.py so that authentication is required for all endpoints (the current state is that it applies no authentication to any endpoint).
fprime-gds Flask application (src/fprime_gds/flask/app.py) authentication_required_for_endpoints = true - Configuration
Harden src/fprime_gds/flask/updown.py to prevent path traversal so the application cannot read/write files outside the upload directory.
fprime-gds Flask upload handling (src/fprime_gds/flask/updown.py) path_traversal_protection = enabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72577?
CVE-2026-72577 has a severity rating of critical at 9.8.
How do I fix CVE-2026-72577?
To fix CVE-2026-72577, update to the latest version of NASA fprime-gds that addresses this vulnerability.
What types of attacks does CVE-2026-72577 allow?
CVE-2026-72577 allows for unauthenticated remote code execution and spacecraft command injection.
Which software is affected by CVE-2026-72577?
CVE-2026-72577 affects NASA's fprime-gds software versions up to 3.4.3.
Is authentication enforced in CVE-2026-72577?
No, CVE-2026-72577 indicates that the Flask application does not enforce authentication.