Ground Station, an open-source satellite-tracking suite with more than 4,800 stars on GitHub, carried four unauthenticated bugs that let anyone who could reach its network port hijack antenna hardware, wipe its database, or run code on the host machine. The vulnerabilities, disclosed between June and August 2026, all trace back to one design flaw: a Socket.IO command channel that accepted instructions from any client, no login required.
A single interface for real hardware
Built for amateur radio operators, satellite enthusiasts and researchers, Ground Station bundles orbit propagation, antenna rotator control, software-defined radio reception, telemetry decoding and pass scheduling into a single browser-based interface, according to the project's repository page. The tool, maintained by developer Efstratios Goudelis, is meant to run on a trusted private network. Instances exposed to the open internet, whether for remote operation of a home station or as part of a shared observatory setup, had no login screen standing between a visitor and the antenna.
Four unauthenticated paths in
The most severe bug, CVE-2026-53451, scored 9.8 out of 10 on the CVSS scale. It chained an authentication-free file write in the save-waterfall-snapshot command with the software's own logging configuration loader: an attacker could plant a malicious YAML file through path traversal, point the app at it using the unauthenticated update-app-config command, then trigger a restart to execute arbitrary code with the service's privileges, according to the flaw's technical writeup on vulnerability tracker cvefeed.io.
Three more bugs abused the same open command channel. CVE-2026-53983, rated 9.2, let an unauthenticated client register an attacker-controlled URL as an orbital data source, turning the ground station into a blind server-side-request-forgery relay that re-fired every 24 hours and could reach internal network addresses, including cloud metadata endpoints. CVE-2026-53984, rated 9.1, let anyone issue a database restore command that wiped every table, destroying satellite records, hardware configurations and observation schedules, or rebuilt the database with attacker-supplied SQL. CVE-2026-53985 let a remote client kill the tracking process outright with a single restart command, halting SDR recording, telemetry decoding and rotator control in the process. The maintainer detailed all three fixes in a GitHub Security Advisory.
The ground segment's familiar weak point
The fixes, folded into versions 0.4.13 and 0.6.0, add mandatory authentication outside the software's initial setup mode and restrict sensitive commands to admin accounts. Credit for the report that triggered the first advisory went to VulnCheck researcher kdalal-vulncheck. The underlying pattern, software wired to real RF hardware but built and deployed like an internal tool, matches a wider concern raised by the Bloomsbury Intelligence and Security Institute, whose research into North American ground segments points to unpatched legacy software and commercial off-the-shelf components as the likeliest entry points for lower-tier attackers, including ransomware crews that target small commercial ground stations for data rather than satellite control.
Since the disclosures, each CVE has surfaced in one of CISA's weekly vulnerability bulletins, which compile new National Vulnerability Database entries automatically regardless of a project's size or user base, giving downstream users of the hobbyist tool a federal paper trail even if they never read the original advisory.
First disclosed in a GitHub Security Advisory published by the Ground Station project's maintainer, with the initial report credited to VulnCheck researcher kdalal-vulncheck.
