CVE-2026-72577

Published: Ago 10, 2026 Last Modified: Ago 10, 2026
ExploitDB:
Other exploit source:
Google Dorks:
CRITICAL 9,8
Source: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: high
Integrity: high
Availability: high

Description

AI Translation Available

Multiple vulnerabilities in NASA fprime-gds through 3.4.3 allow an unauthenticated remote attacker to achieve arbitrary code execution on the ground station host and inject arbitrary commands to connected spacecraft. The Flask application in src/fprime_gds/flask/app.py applies no authentication to any endpoint.

306

Missing Authentication for Critical Function

Draft
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Access Control Other
Potential Impacts:
Gain Privileges Or Assume Identity Varies By Context
Applicable Platforms
Technologies: Cloud Computing, ICS/OT
Likelihood of Exploit: High
View CWE Details
https://github.com/nasa/fprime-gds
https://github.com/nasa/fprime-gds
https://github.com/nasa/fprime-gds/blob/main/src/fprime_gds…
https://github.com/nasa/fprime-gds/blob/main/src/fprime_gds/flask/commands.py
https://github.com/nasa/fprime-gds/blob/main/src/fprime_gds…
https://github.com/nasa/fprime-gds/blob/main/src/fprime_gds/flask/updown.py
https://pypi.org/project/fprime-gds/
https://pypi.org/project/fprime-gds/