Vulnerability · Published Aug 6, 2026 · Assigned by VulnCheck
CVE-2026-53985Ground Station prior to 0.6.0 Unauthenticated DoS via service_control Socket.IO
High 7.5
In plain English
A high-severity missing authentication in Ground Station from Efstratios Goudelis. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).
Official description
Ground Station prior to 0.6.0 contains an unauthenticated denial-of-service vulnerability in the Socket.IO server's service_control event handler that allows any unauthenticated network peer to forcibly terminate the ground-station process by sending a single restart_service command. Attackers can connect to the Socket.IO server on port 7000 without credentials due to disabled authentication enforcement and a wildcard CORS policy, then emit the service_control event to terminate all active satellite-tracking sessions, SDR recording pipelines, demodulators, decoders, and rotator controllers, with repeated triggering possible in Docker deployments to create a persistent denial-of-service condition.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Efstratios Goudelis | Ground Station | 0 – before 0.6.0 |
Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- Product Advisory product
- GitHub Security Advisory vendor-advisory
- Patch Commit patch