Which versions of Ground Station are affected by CVE-2026-53985?

Ground Station prior to version 0.6.0 contains an unauthenticated denial-of-service vulnerability that allows any network-connected peer to instantly crash the application with a single malicious…. A patch is available.

How to fix or mitigate CVE-2026-53985?

Within 24 hours: identify all Ground Station deployments and current versions, then immediately restrict network access to port 7000 using firewall rules to trusted administrative hosts only. Within 7 days: upgrade all vulnerable instances to Ground Station version 0.6.0 or later, validate the patch in staging environments against existing SDR pipelines and rotator controller configurations, and confirm successful application restarts. Within 30 days: complete production deployment of patched versions across all satellite tracking sites, implement continuous monitoring to detect unauthorized access attempts to port 7000, and enforce network segmentation to limit port 7000 exposure to administrative interfaces only.

Ground Station CVE-2026-53985

Q: What is the CVSS score of CVE-2026-53985?

CVE-2026-53985 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-54095 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-08-06 VulnCheck

GHSA-9h78-49rc-9p23

Authentication Bypass Docker Ground Station

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Network-reachable with no authentication and no complexity; impact is availability-only with no confidentiality or integrity effect, so C:N/I:N/A:H and no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Aug 06, 2026 - 16:08 vuln.today

Analysis Generated

Aug 06, 2026 - 16:08 vuln.today

CVE Published

Aug 06, 2026 - 15:19 cve.org

HIGH 8.7

DescriptionCVE.org

Ground Station prior to 0.6.0 contains an unauthenticated denial-of-service vulnerability in the Socket.IO server's service_control event handler that allows any unauthenticated network peer to forcibly terminate the ground-station process by sending a single restart_service command. Attackers can connect to the Socket.IO server on port 7000 without credentials due to disabled authentication enforcement and a wildcard CORS policy, then emit the service_control event to terminate all active satellite-tracking sessions, SDR recording pipelines, demodulators, decoders, and rotator controllers, with repeated triggering possible in Docker deployments to create a persistent denial-of-service condition.

Articles & Coverage 1

News 3 New Docker Vulnerabilities - 1 Critical, 2 High Severity Aug 06, 2026

AnalysisAI

Unauthenticated denial-of-service in sgoudelis/Ground Station prior to 0.6.0 allows any network peer to forcibly terminate the application process by emitting a single Socket.IO event requiring no credentials. Authentication enforcement is disabled and a wildcard CORS policy is in place, exposing the service_control handler - which triggers process shutdown via a restart_service command - to any host with TCP access to port 7000. In Docker deployments, the attack can be repeated in a loop to sustain a persistent outage of all satellite-tracking sessions, SDR recording pipelines, demodulators, decoders, and rotator controllers. No public exploit or CISA KEV listing is identified at time of analysis.

Technical ContextAI

Ground Station (CPE: cpe:2.3:a:efstratios_goudelis:ground_station) is an open-source Python application for satellite tracking, SDR recording, and antenna rotator control, using a Socket.IO server for real-time event-driven communication between clients and backend services on port 7000. The root cause is CWE-306 (Missing Authentication for Critical Function): the service_control event handler, which can invoke a restart_service command that terminates the ground-station process and all dependent pipelines, is registered on the Socket.IO server without any authentication middleware or session token validation. A wildcard CORS policy further removes browser-enforced origin restrictions, allowing connections from arbitrary web origins in addition to native Socket.IO clients. This means any TCP-reachable peer, not just browsers, can connect and emit the privileged control event without credentials.

RemediationAI

Upgrade Ground Station to version 0.6.0 or later, which is confirmed as the patched release per the CVE description. The upstream code fix is available at commit 2ecde82a8814cbea18883ce023bf45cbf06172eb (https://github.com/sgoudelis/ground-station/commit/2ecde82a8814cbea18883ce023bf45cbf06172eb); the vendor security advisory at https://github.com/sgoudelis/ground-station/security/advisories/GHSA-mjp8-x6h7-229q should be consulted for full remediation guidance. If immediate upgrade is not feasible, restrict TCP access to port 7000 using host-based firewall rules (e.g., iptables, ufw, or nftables) to allow only trusted IP addresses - this blocks the unauthenticated connection at the network layer with minimal operational side effect for single-operator deployments. In Docker environments, apply docker network isolation or publish port 7000 only to localhost (127.0.0.1:7000) rather than all interfaces. Note that reconfiguring CORS alone is insufficient mitigation, as native Socket.IO clients (non-browser) are not subject to CORS enforcement.