CVE-2026-67972: NASA cFS Information Disclosure Flaw

CVE-2026-67972 Overview

CVE-2026-67972 affects the CF_CFDP_RecvMd() component of NASA core Flight System (cFS) version 7.0.1. The flaw allows attackers to control where received content and data is stored during CCSDS File Delivery Protocol (CFDP) metadata reception. This behavior can lead to information disclosure by redirecting file writes to attacker-chosen locations. NASA cFS is a widely deployed flight software framework used in spacecraft and embedded avionics systems, making the exposure relevant to space and aerospace mission operators.

Critical Impact
Attackers who can send crafted CFDP metadata packets to a vulnerable cFS instance may influence file storage paths, potentially exposing mission data or overwriting sensitive files.

Affected Products

NASA core Flight System (cFS) version 7.0.1
Deployments incorporating the CF (CFDP) application component
Downstream mission software bundling the affected CF_CFDP_RecvMd() routine

Discovery Timeline

2026-08-03 - CVE-2026-67972 published to the National Vulnerability Database
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-67972

Vulnerability Analysis

The vulnerability resides in CF_CFDP_RecvMd(), the function responsible for processing incoming CFDP metadata Protocol Data Units (PDUs). CFDP metadata PDUs carry file naming and transfer parameters, including source and destination paths for files transferred to the flight software. The affected routine does not sufficiently constrain or validate the destination path field supplied by the sender. An attacker able to transmit CFDP traffic to the target can therefore direct writes to locations outside the intended CFDP working directory. This gives the attacker leverage to place data into sensitive filesystem locations or to influence subsequent read operations that leak content.

Root Cause

The root cause is improper input validation of attacker-controlled path metadata within the CFDP receive path. The CF_CFDP_RecvMd() handler trusts the destination filename provided in the metadata PDU without enforcing a strict allowlist or canonicalization against the configured CFDP root. Refer to the GitHub cFS Issue #1073 discussion for the upstream analysis.

Attack Vector

Exploitation requires the ability to deliver CFDP metadata PDUs to the affected cFS instance. In mission contexts, this typically means access to the command uplink, a ground segment relay, or an intermediate network able to inject CFDP traffic. Once the attacker submits a crafted metadata PDU with a manipulated destination path, subsequent file data PDUs are written to the attacker-influenced location. This can produce information disclosure when the resulting file is later transmitted, mirrored, or made accessible through other flight software interfaces. No verified public proof-of-concept code is available; see the NASA cFS repository for source references.

Detection Methods for CVE-2026-67972

Indicators of Compromise

CFDP metadata PDUs containing path separators, parent directory traversal sequences, or absolute paths in the destination filename field
Unexpected file creations outside the configured CFDP downlink or uplink working directory on the flight filesystem
CFDP transaction logs showing destination filenames that do not match the mission-defined naming convention

Detection Strategies

Inspect CFDP metadata PDUs at the ground segment and reject any containing traversal characters or unexpected path prefixes before uplink
Enable and review cFS Event Services (EVS) messages emitted by the CF application for anomalous filename handling
Compare on-board filesystem snapshots against expected baselines to identify writes originating outside the CFDP root

Monitoring Recommendations

Log every CFDP transaction ID with its associated source entity, destination filename, and resulting on-board path
Alert on any CFDP receive operation that resolves to a path outside the sanctioned working directory
Correlate telemetry from the ground CFDP engine with on-board file system telemetry to detect divergence

How to Mitigate CVE-2026-67972

Immediate Actions Required

Restrict CFDP uplink to authenticated and authorized ground stations only, using link-layer or transport-layer controls
Apply ground-side filtering that strips or rejects metadata PDUs containing path traversal sequences or absolute paths
Audit existing on-board filesystem contents for files written outside the expected CFDP directory

Patch Information

No fixed version is listed in the NVD entry for CVE-2026-67972 at publication time. Monitor the NASA cFS repository and cFS Issue #1073 for upstream remediation guidance and pull requests addressing CF_CFDP_RecvMd() path handling.

Workarounds

Configure the CF application to operate against a dedicated, isolated directory with no symbolic links to sensitive paths
Apply operating system level file permissions on the flight filesystem so that only the CFDP working directory is writable by the CF task
Implement a wrapper or preprocessing step that canonicalizes and validates incoming CFDP destination filenames before they reach CF_CFDP_RecvMd()

bash

# Configuration example
# Enforce a restricted CFDP working directory and validate incoming filenames
# Example: reject metadata PDUs whose destination path escapes the CFDP root
cfdp_root="/cf/downlink"
case "$dest_filename" in
  */..*|/*) echo "Reject: unsafe CFDP destination path"; exit 1 ;;
  *) echo "Accept: $cfdp_root/$dest_filename" ;;
esac