Description
Ground Station prior to 0.6.0 contains an unauthenticated blind server-side request forgery vulnerability in the orbital-source configuration path that allows any unauthenticated Socket.IO client to cause the ground-station process to issue outbound HTTP requests to attacker-chosen destinations. Attackers can connect to the Socket.IO server on port 7000 without credentials due to disabled authentication enforcement and a wildcard CORS policy, then submit a data_submission event with submit-orbital-sources action to persist an attacker-supplied URL in the database, then trigger an orbital sync via the equally unauthenticated background_task:start event. The URL is stored with no scheme allowlist, no host validation, and no rejection of loopback, RFC1918, or link-local (cloud instance metadata at 169.254.169.254) addresses, and is passed directly to requests.get in _fetch_http_3le and _fetch_http_omm in backend/tlesync/source_adapters.py. HTTP status codes and error messages from the outbound request are emitted in the orbital_sync_state Socket.IO event to all connected clients, providing a serviceable oracle for interpreting internal-service and cloud-metadata responses even though the raw response body is not directly leaked. Because the malicious source persists in the database across restarts and re-fires every 24 hours on the scheduled sync cycle, the primitive gives durable long-term SSRF without the attacker needing to remain connected.
Published: 2026-08-06
Score: 9.2 Critical
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Ground Station versions before 0.6.0 allow an unauthenticated user to use the Socket.IO interface on port 7000 to persist a malicious orbital source URL in the database. The application fails to validate or sanitise the supplied URL, and the same URL is used by the backend to perform an outbound HTTP request. The request’s status code and error message are returned to all connected clients, giving attackers a stealthy oracle to discover internal or cloud‑metadata responses. The flaw is a blind SSRF that can be triggered without user interaction and its persistence across restarts makes it a durable long‑term threat.

Affected Systems

The affected vendor is Efstratios Goudelis, and the product is Ground Station. Any deployment running a version earlier than 0.6.0 is vulnerable.

Risk and Exploitability

The CVSS base score of 9.2 classifies this as critical. Because there is no authentication and the Socket.IO server permits connections from any origin, an attacker can reach the service if port 7000 is exposed. The lack of a host whitelist, scheme restriction, or loopback block means the attacker can target internal IPs, RFC1918 ranges, or the instance‑metadata service at 169.254.169.254, potentially reading private data or facilitating lateral movement. The EPSS score is not publicly available, and the vulnerability is not yet listed in CISA’s KEV catalog, but the high severity and broad exploitation surface warrants urgent attention.

Generated by OpenCVE AI on August 7, 2026 at 01:14 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Ground Station to 0.6.0 or later, where the SSRF vulnerability has been addressed.
  • Enable authentication for the Socket.IO endpoints and enforce a strict CORS policy to limit access to trusted origins.
  • Add validation and filtering for orbital-source URLs, allowing only trusted schemes, rejecting loopback, RFC1918, and link‑local addresses, and rejecting known metadata endpoints.

Generated by OpenCVE AI on August 7, 2026 at 01:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 06 Aug 2026 22:15:00 +0000

Type Values Removed Values Added
Description Ground Station prior to 0.6.0 contains an unauthenticated blind server-side request forgery vulnerability in the orbital-source configuration path that allows any unauthenticated Socket.IO client to cause the ground-station process to issue outbound HTTP requests to attacker-chosen destinations. Attackers can connect to the Socket.IO server on port 7000 without credentials due to disabled authentication enforcement and a wildcard CORS policy, then submit a data_submission event with submit-orbital-sources action to persist an attacker-supplied URL in the database, then trigger an orbital sync via the equally unauthenticated background_task:start event. The URL is stored with no scheme allowlist, no host validation, and no rejection of loopback, RFC1918, or link-local (cloud instance metadata at 169.254.169.254) addresses, and is passed directly to requests.get in _fetch_http_3le and _fetch_http_omm in backend/tlesync/source_adapters.py. HTTP status codes and error messages from the outbound request are emitted in the orbital_sync_state Socket.IO event to all connected clients, providing a serviceable oracle for interpreting internal-service and cloud-metadata responses even though the raw response body is not directly leaked. Because the malicious source persists in the database across restarts and re-fires every 24 hours on the scheduled sync cycle, the primitive gives durable long-term SSRF without the attacker needing to remain connected.
Title Ground Station prior to 0.6.0 Unauthenticated Persistent Blind Server-Side Request Forgery via Orbital Data Source URL
Weaknesses CWE-918
References
Metrics cvssV3_1

{'score': 8.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N'}

cvssV4_0

{'score': 9.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-08-06T15:38:02.143Z

Reserved: 2026-06-11T16:07:13.000Z

Link: CVE-2026-53983

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-07T01:15:05Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)