CVE-2026-72577: NASA fprime-gds - Missing Authentication and Path Traversal Enable Unauthenticated RCE and Spacecraft Command Injection
Multiple vulnerabilities in NASA fprime-gds through 3.4.3 allow an unauthenticated remote attacker to achieve arbitrary code execution on the ground station host and inject arbitrary commands to connected spacecraft. The Flask application in src/fprimegds/flask/app.py applies no authentication to any endpoint.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Configure the Flask app so that endpoints in src/fprime_gds/flask/app.py require authentication instead of applying no authentication to any endpoint.
NASA fprime-gds Flask application (src/fprime_gds/flask/app.py) Authentication enforcement on endpoints = enabled - Compensating control
Restrict network access to the fprime-gds Flask service so unauthenticated remote attackers cannot reach it (e.g., firewall/ACL allowing only trusted management hosts/networks).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72577?
CVE-2026-72577 has a severity rating of critical at 9.8.
How do I fix CVE-2026-72577?
To fix CVE-2026-72577, update to the latest version of NASA fprime-gds that addresses this vulnerability.
What types of attacks does CVE-2026-72577 allow?
CVE-2026-72577 allows for unauthenticated remote code execution and spacecraft command injection.
Which software is affected by CVE-2026-72577?
CVE-2026-72577 affects NASA's fprime-gds software versions up to 3.4.3.
Is authentication enforced in CVE-2026-72577?
No, CVE-2026-72577 indicates that the Flask application does not enforce authentication.