PatchSiren cyber security CVE debrief
CVE-2026-53983 Efstratios Goudelis CVE debrief
Ground Station prior to 0.6.0 contains an unauthenticated blind server-side request forgery vulnerability in the orbital-source configuration path that allows any unauthenticated Socket.IO client to cause the ground-station process to issue outbound HTTP requests to attacker-chosen destinations. Attackers can connect to the Socket.IO server on port 7000 without credentials due to disabled authentication enforcement and a wildcard CORS policy, then submit a data_submission event with submit-orbital-sources action to persist an attacker-supplied URL in the database, then trigger an orbital sync via the equally unauthenticated background_task:start event. The URL is stored with no scheme allowlist, no host validation, and no rejection of loopback, RFC1918, or link-local (cloud instance metadata at 169.254.169.254) addresses, and is passed directly to requests.get in _fetch_http_3le and _fetch_http_omm in backend/tlesync/source_adapters.py. HTTP status codes and error messages from the outbound request are emitted in the orbital_sync_state Socket.IO event to all connected clients, providing a serviceable oracle for interpreting internal-service and cloud-metadata responses even though the raw response body is not directly leaked. Because the malicious source persists in the database across restarts and re-fires every 24 hours on the scheduled sync cycle, the primitive gives durable long-term SSRF without the attacker needing to remain connected. This vulnerability is rated as CRITICAL with a CVSS score of 9.2. Users of Ground Station should prioritize immediate defensive actions to protect their installations.
- Vendor
- Efstratios Goudelis
- Product
- Ground Station
- CVSS
- CRITICAL 9.2
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-08-06
- Original CVE updated
- 2026-08-07
- Advisory published
- 2026-08-06
- Advisory updated
- 2026-08-07
Who should care
Users of Ground Station prior to version 0.6.0 should be aware of this vulnerability and take immediate action to protect their installations. This includes administrators of Ground Station, security teams monitoring for potential threats, and developers responsible for maintaining the Ground Station codebase.
Technical summary
CVE-2026-53983 is an unauthenticated blind server-side request forgery vulnerability in Ground Station prior to 0.6.0. The vulnerability allows any unauthenticated Socket.IO client to cause the ground-station process to issue outbound HTTP requests to attacker-chosen destinations. This is possible due to disabled authentication enforcement and a wildcard CORS policy. The attacker can connect to the Socket.IO server on port 7000 without credentials, submit a data_submission event with submit-orbital-sources action to persist an attacker-supplied URL in the database, and trigger an orbital sync via the equally unauthenticated background_task:start event. The URL is stored with no scheme allowlist, no host validation, and no rejection of loopback, RFC1918, or link-local addresses, and is passed directly to requests.get in _fetch_http_3le and _fetch_http_omm in backend/tlesync/source_adapters.py.
Defensive priority
CVE-2026-53983 is rated as CRITICAL with a CVSS score of 9.2. Ground Station prior to 0.6.0 contains an unauthenticated blind server-side request forgery vulnerability. Users should prioritize immediate defensive actions.
Recommended defensive actions
- Review and apply the vendor's patch for Ground Station version 0.6.0 or later.
- Restrict access to the Socket.IO server on port 7000 to only trusted clients.
- Implement authentication and authorization for Socket.IO clients.
- Monitor for suspicious activity on the ground-station process and network traffic.
- Perform inventory checks to identify affected Ground Station installations.
Evidence notes
The CVE-2026-53983 details indicate an unauthenticated blind server-side request forgery vulnerability exists in Ground Station prior to 0.6.0. The vulnerability allows any unauthenticated Socket.IO client to cause the ground-station process to issue outbound HTTP requests to attacker-chosen destinations. Evidence is based on official CVE and NVD records.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-06T22:17:42.120Z and has not been modified since then.