CVE-2026-103244
ground-station versions before 0.8.0 contain an authentication bypass vulnerability in the…
- Risk score
- 73/100
- CVSS
- 9.8 v3.1
- Exploit chance (30 days)
- 0.6%
- Published
- 1 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- ground-station versions before 0.8.0 contain an authentication bypass vulnerability in the setup.restore command that allows unauthenticated attackers to execute arbitrary SQL during first-run setup mode. Attackers can invoke setup.restore via Socket.IO to plant admin users and forged session tokens, then authenticate…
- Affected
- See advisory
- Fix
- Upgrade the product to 0.8.0 or later.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 9.8 critical
- Remotely exploitable without logging in
References
- https://github.com/sgoudelis/ground-station/commit/940df2128e57fa779d0ddee2d9726bd829fc61e1
- https://github.com/sgoudelis/ground-station/security/advisories/GHSA-3mqj-q84c-crjq
- https://www.vulncheck.com/advisories/ground-station-before-0.8.0-authentication-bypass-via-setup-restore
- https://github.com/sgoudelis/ground-station/security/advisories/GHSA-3mqj-q84c-crjq
Original description
ground-station versions before 0.8.0 contain an authentication bypass vulnerability in the setup.restore command that allows unauthenticated attackers to execute arbitrary SQL during first-run setup mode. Attackers can invoke setup.restore via Socket.IO to plant admin users and forged session tokens, then authenticate as administrator without credentials for complete application takeover.
Last activity 1 Oct 2026. Patch Forecast updates every hour.