CVE-2026-53983

Received Received - Intake

Ground Station SSRF via Unauthenticated Socket.IO Events

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: VulnCheck

Description

Ground Station prior to 0.6.0 contains an unauthenticated blind server-side request forgery vulnerability in the orbital-source configuration path that allows any unauthenticated Socket.IO client to cause the ground-station process to issue outbound HTTP requests to attacker-chosen destinations. Attackers can connect to the Socket.IO server on port 7000 without credentials due to disabled authentication enforcement and a wildcard CORS policy, then submit a data_submission event with submit-orbital-sources action to persist an attacker-supplied URL in the database, then trigger an orbital sync via the equally unauthenticated background_task:start event. The URL is stored with no scheme allowlist, no host validation, and no rejection of loopback, RFC1918, or link-local (cloud instance metadata at 169.254.169.254) addresses, and is passed directly to requests.get in _fetch_http_3le and _fetch_http_omm in backend/tlesync/source_adapters.py. HTTP status codes and error messages from the outbound request are emitted in the orbital_sync_state Socket.IO event to all connected clients, providing a serviceable oracle for interpreting internal-service and cloud-metadata responses even though the raw response body is not directly leaked. Because the malicious source persists in the database across restarts and re-fires every 24 hours on the scheduled sync cycle, the primitive gives durable long-term SSRF without the attacker needing to remain connected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-53983

Affected Vendors & Products

Vendor	Product	Version / Range
ground_station	ground_station	to 0.6.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

Ground Station prior to 0.6.0 has an unauthenticated blind server-side request forgery (SSRF) vulnerability. Attackers can connect to the Socket.IO server without credentials and submit malicious events to cause the system to make outbound HTTP requests to any destination, including internal services or cloud metadata endpoints. The URL is stored without validation and reused every 24 hours, enabling long-term SSRF without requiring persistent attacker access.

Detection Guidance

Check for unauthenticated connections to port 7000 using tools like netstat or ss. Monitor for outbound HTTP requests to unexpected destinations, especially RFC1918, loopback, or metadata service addresses (169.254.169.254). Inspect database entries for malicious URLs in the orbital-source configuration path.

Impact Analysis

This vulnerability allows attackers to access internal services, cloud metadata (like AWS IMDS), or other restricted systems through your Ground Station instance. They can exfiltrate sensitive data, probe internal networks, or interact with services as if they were the server itself. The impact includes data leakage, unauthorized access to internal resources, and potential lateral movement within your infrastructure.

Compliance Impact

This SSRF vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles or HIPAA's safeguards for protected health information. It may result in data breaches, unauthorized disclosures, or failure to maintain confidentiality and integrity of personal or health data, potentially leading to regulatory penalties or compliance violations.

Mitigation Strategies

Upgrade Ground Station to version 0.6.0 or later. Enable authentication enforcement and restrict CORS policies. Implement scheme, host, and address validation for URLs. Block outbound requests to RFC1918, loopback, and metadata service addresses. Remove any unauthorized URLs from the orbital-source configuration.

Hi! I’m here to help you understand CVE-2026-53983. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70