CVE-2026-72577 NASA CVE debrief

Who should care

Organizations using NASA fprime-gds through 3.4.3 should prioritize patching this vulnerability to prevent potential attacks. This vulnerability allows an unauthenticated remote attacker to achieve arbitrary code execution on the ground station host and inject arbitrary commands to connected spacecraft. Affected operators should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Security teams should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Technical summary

Multiple vulnerabilities in NASA fprime-gds through 3.4.3 allow an unauthenticated remote attacker to achieve arbitrary code execution on the ground station host and inject arbitrary commands to connected spacecraft. The Flask application in src/fprime_gds/flask/app.py applies no authentication to any endpoint, which allows an unauthenticated remote attacker to achieve arbitrary code execution on the ground station host and inject arbitrary commands to connected spacecraft. Organizations using NASA fprime-gds through 3.4.3 should prioritize patching this vulnerability to prevent potential attacks.

Defensive priority

Immediate attention is required due to the critical severity of this vulnerability.

Recommended defensive actions

• Verify the authenticity of all endpoints in the Flask application.
• Implement authentication and authorization for all endpoints.
• Restrict access to the ground station host and connected spacecraft.
• Monitor for suspicious activity and implement compensating controls.
• Update to the latest version of fprime-gds.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The source corpus provides limited information about the vulnerability in NASA fprime-gds through 3.4.3. Further investigation is needed to determine the full scope of the vulnerability and affected systems. Organizations should verify the authenticity of all endpoints in the Flask application and implement authentication and authorization for all endpoints. The CVE record was published on 2026-08-10T11:17:30.533Z and has not been modified since then. The Flask application in src/fprime_gds/flask/app.py applies no authentication to any endpoint, which allows an unauthenticated remote attacker to achieve arbitrary code execution on the ground station host and inject arbitrary commands to connected spacecraft.

Official resources