CVE-2026-103244GHSA-3mqj-q84c-crjq
ground-station before 0.8.0 Authentication Bypass via setup.restore
sgoudelis ground-station
CVSS
9.3CriticalExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 1 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.56%Chance of exploitation activity in the next 30 days, higher than 46% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 0.8.0ground-stationCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
ground-station versions before 0.8.0 contain an authentication bypass vulnerability in the setup.restore command that allows unauthenticated attackers to execute arbitrary SQL during first-run setup mode. Attackers can invoke setup.restore via Socket.IO to plant admin users and forged session tokens, then authenticate as administrator without credentials for complete application takeover.
Text from CVE List
Affected versions 1
- ground-stationaffected: all versions before 0.8.0CVE List
References 3
- github.com/sgoudelis/ground-station/commit/940df2128e57fa779d0ddee2d9726bd829fc61e1Fixvia CVE List
- vulncheck.com/advisories/ground-station-before-0.8.0-authentication-bypass-via-setup-restoreAdvisoryvia CVE List
- github.com/sgoudelis/ground-station/security/advisories/GHSA-3mqj-q84c-crjqExploitvia CVE List