CVE-2026-53983

Name of the Vulnerable Software and Affected Versions Ground Station versions prior to 0.6.0

Description An unauthenticated blind server-side request forgery (SSRF) exists in the orbital-source configuration path. This allows an unauthenticated Socket.IO client to force the process to issue outbound HTTP requests to arbitrary destinations. Attackers can connect to the Socket.IO server on port 7000 without credentials due to disabled authentication and a wildcard CORS policy. By submitting a data submission event with a submit-orbital-sources action, an attacker can persist a URL in the database. Triggering an orbital sync via the background task:start event then causes the system to process this URL. The system fails to implement a scheme allowlist, host validation, or rejection of loopback, RFC1918, or link-local addresses (such as cloud instance metadata at 169.254.169.254). The URL is passed directly to requests.get within the fetch http 3le() and fetch http omm() functions in backend/tlesync/source adapters.py. While the raw response body is not leaked, HTTP status codes and error messages are emitted via the orbital sync state Socket.IO event, acting as an oracle for interpreting internal-service and cloud-metadata responses. This effect is durable as the malicious source persists in the database and re-triggers every 24 hours during the scheduled sync cycle.

Recommendations Update Ground Station to version 0.6.0 or later.