CVE-2026-67975 Overview
CVE-2026-67975 is an incorrect access control vulnerability in NASA's Core Flight System (cFS) version 7.0.1. The flaw resides in the TO_LAB (Telemetry Output Lab) application, which processes add and remove subscription commands without adequate authorization checks. Attackers can send crafted TO_LAB subscription commands to arbitrarily remove low-index subscriptions and add new telemetry streams. This manipulation disrupts the intended telemetry routing and undermines the integrity of downlinked data from flight software.
Critical Impact
Attackers can manipulate telemetry subscriptions in NASA cFS v7.0.1 deployments, removing legitimate data streams and injecting attacker-controlled streams through TO_LAB commands.
Affected Products
- NASA Core Flight System (cFS) version 7.0.1
- Deployments using the bundled TO_LAB telemetry output application
- Flight software builds that expose TO_LAB command interfaces without additional access controls
Discovery Timeline
- 2026-08-03 - CVE-2026-67975 published to the National Vulnerability Database
- 2026-08-03 - Last updated in the NVD database
Technical Details for CVE-2026-67975
Vulnerability Analysis
The Core Flight System (cFS) is NASA's open-source flight software framework used for spacecraft and embedded aerospace platforms. The TO_LAB application is a reference telemetry output module that manages subscription tables mapping message IDs to downlink streams. cFS v7.0.1 exposes add and remove subscription commands on this application without enforcing access control on the command source or subscription index.
An attacker capable of injecting commands into the Software Bus can invoke the remove subscription command against low-index entries. Low-index subscriptions typically hold critical telemetry channels registered during system initialization. Removing them silently disables downlink of the corresponding messages. The attacker can then add new streams routed to attacker-controlled destinations. The behavior is discussed in the GitHub Issue #1076 Discussion.
Root Cause
The root cause is missing authorization on TO_LAB add and remove subscription command handlers. The handlers accept any well-formed command message from the Software Bus and apply it directly to the subscription table. There is no validation that the requesting entity is authorized to modify subscription state or that low-index entries are protected from removal. This is a broken access control weakness in command processing logic.
Attack Vector
Exploitation requires the ability to publish command packets on the cFS Software Bus targeting the TO_LAB application. In lab and test environments, this interface is often reachable over the network via the command ingest module. An attacker with such reachability sends a remove subscription command referencing a low-index message ID to disable existing telemetry, then sends an add subscription command specifying attacker-chosen message IDs and downlink parameters. No authentication or authorization tokens are required.
No verified proof-of-concept code has been published. Refer to the GitHub cFS Project Repository and the linked issue for command definitions and reproduction context.
Detection Methods for CVE-2026-67975
Indicators of Compromise
- Unexpected TO_LAB remove subscription commands targeting low-index entries in Software Bus command logs
- New TO_LAB add subscription entries pointing to unfamiliar destination IP addresses or ports
- Sudden loss of expected telemetry message IDs on downlink while the flight system remains nominal
Detection Strategies
- Baseline the TO_LAB subscription table after initialization and alert on any runtime deviation
- Enable command counter and event message monitoring on the TO_LAB application to catch subscription modification events
- Correlate command ingest logs with telemetry output logs to identify subscription changes originating from unauthorized sources
Monitoring Recommendations
- Forward cFS Executive Services and TO_LAB event messages to a centralized log aggregator for continuous review
- Monitor network interfaces exposing the cFS command ingest port for command traffic from unexpected hosts
- Track the count and identity of active subscriptions and alert on changes outside authorized maintenance windows
How to Mitigate CVE-2026-67975
Immediate Actions Required
- Restrict network access to the cFS command ingest interface so only authorized ground systems can reach TO_LAB
- Disable or remove the TO_LAB application in production or flight builds where lab telemetry output is not required
- Audit current TO_LAB subscription tables against the expected baseline and revert unauthorized changes
Patch Information
No official patch identifier is listed in the NVD entry at publication. Consult the GitHub cFS Project Repository and GitHub Issue #1076 Discussion for the latest remediation status, upstream commits, and guidance from the cFS maintainers.
Workarounds
- Place the cFS command ingest interface behind a firewall that permits only trusted ground station addresses
- Modify the TO_LAB command handlers to reject remove subscription commands for a protected range of low-index entries
- Replace TO_LAB with a hardened telemetry output application that authenticates subscription modification commands
# Configuration example: restrict TO_LAB command ingest port at the host firewall
# Replace 10.0.0.5 with the authorized ground system address and 1234 with the configured cmdUtil port
iptables -A INPUT -p udp --dport 1234 -s 10.0.0.5 -j ACCEPT
iptables -A INPUT -p udp --dport 1234 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
