Ground Station CVE-2026-53983

No special conditions - remote unauthenticated exploitation against default configurations of Ground Station (prior to 0.6.0), because authentication enforcement is disabled and CORS is set to wildcard out of the box. The only concrete prerequisites are network reachability to the Socket.IO server on TCP port 7000 and issuing the documented submit-orbital-sources and background_task:start events. Limiting factors: the attacker must be able to route to port 7000 (a deployment firewalled or bound to localhost is not remotely reachable); exploitation is blind, so only HTTP status codes and error strings are returned, not response bodies; and the highest-value metadata oracle only applies when the host runs on a cloud instance exposing 169.254.169.254. Fixed in 0.6.0.

The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:H/SC:H, score 9.2) reflects a genuinely low bar: network-reachable, no authentication, no user interaction, and no special attack requirement, which matches the description's default-configuration exposure. The real-world impact is nonetheless bounded to information disclosure - this is blind SSRF, so raw response bodies are not returned; only HTTP status codes and error messages leak, giving a serviceable but coarse oracle rather than full data exfiltration, which argues for a Low rather than High confidentiality rating in an independent assessment. There is no CISA KEV listing and no public exploit identified at time of analysis, and no EPSS score was provided, so exploitation is currently theoretical despite the high CVSS. The dominant risk driver is the cloud-metadata angle (169.254.169.254): on a cloud-hosted instance the oracle can confirm reachable internal endpoints and metadata responses, potentially staging credential theft, and the 24-hour re-fire makes the primitive persistent. Net: the high-severity signal is credible for reachability, but practical priority depends heavily on whether the instance is internet-exposed on port 7000 and cloud-hosted.

An attacker who can reach port 7000 opens an unauthenticated Socket.IO connection, sends a data_submission event with the submit-orbital-sources action containing a URL such as http://169.254.169.254/latest/meta-data/, then fires background_task:start to force an orbital sync. The ground-station process fetches the URL server-side and broadcasts the HTTP status/error in the orbital_sync_state event, letting the attacker map internal services and confirm cloud-metadata reachability; no public exploit is identified at time of analysis, so this would require attacker tooling against the documented event flow.