CVE-2026-72577: NASA fprime-gds RCE Vulnerability

CVE-2026-72577 Overview

CVE-2026-72577 identifies multiple vulnerabilities in NASA's F' Prime Ground Data System (fprime-gds) through version 3.4.3. The Flask application defined in src/fprime_gds/flask/app.py applies no authentication to any endpoint. An unauthenticated remote attacker can reach the ground station host, execute arbitrary code, and inject arbitrary commands to connected spacecraft. The flaw is tracked under CWE-306: Missing Authentication for Critical Function.

Critical Impact
Unauthenticated remote attackers can execute arbitrary code on the ground station and issue arbitrary commands to connected spacecraft.

Affected Products

NASA fprime-gds versions up to and including 3.4.3
The Flask web application component in src/fprime_gds/flask/app.py
Command and up/down handlers in src/fprime_gds/flask/commands.py and src/fprime_gds/flask/updown.py

Discovery Timeline

2026-08-10 - CVE-2026-72577 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-72577

Vulnerability Analysis

The F' Prime Ground Data System is NASA's ground station software for the F' (F Prime) flight framework used to command and control spacecraft. The fprime-gds package ships a Flask-based HTTP interface that exposes command upload, file transfer, and telemetry endpoints. In versions up to 3.4.3, the Flask application instantiated in src/fprime_gds/flask/app.py registers all routes without any authentication decorator, middleware, or session check.

An attacker with network access to the ground station reaches privileged endpoints directly. The command endpoints defined in commands.py accept command arguments and forward them to the connected spacecraft. The file transfer endpoints in updown.py accept uploads and downloads to and from the host filesystem. Combined, these exposed handlers permit arbitrary code execution on the ground station host and arbitrary command injection to the spacecraft link.

Root Cause

The root cause is a missing authentication control on critical functionality [CWE-306]. The Flask application does not enforce identity verification, API keys, tokens, or transport-layer client certificates on any route. Every endpoint registered by the ground data system is reachable by any client that can establish a TCP connection to the service port.

Attack Vector

Exploitation requires only network reachability to the Flask service. No user interaction, credentials, or prior privileges are required. An attacker sends crafted HTTP requests to the command, file transfer, or dictionary endpoints. Command injection to the spacecraft occurs through the uplink handler, while code execution on the host occurs through file write primitives exposed by the up/down interface.

Refer to the source files in the NASA fprime-gds repository, specifically commands.py and updown.py, for the affected route definitions.

Detection Methods for CVE-2026-72577

Indicators of Compromise

Unexpected HTTP requests to fprime-gds Flask endpoints originating from IP addresses outside the operator subnet
Unauthorized file writes under directories used by the up/down handler on the ground station host
Spacecraft command sequences in mission logs that do not correlate with authorized operator sessions
New or modified Python files, cron entries, or systemd units on the ground station host following external HTTP activity

Detection Strategies

Inspect HTTP access logs from the fprime-gds Flask process for requests to command, file upload, and dictionary routes from unexpected sources
Correlate uplinked spacecraft command records with authenticated operator activity to surface unattributed commands
Monitor process creation on the ground station host for child processes spawned by the Python Flask worker

Monitoring Recommendations

Forward fprime-gds application logs, host process telemetry, and network flow records to a centralized analytics platform for correlation
Alert on any inbound connection to the Flask listener from outside a defined operator allowlist
Track filesystem changes in directories used by the up/down endpoint and in Python site-packages

How to Mitigate CVE-2026-72577

Immediate Actions Required

Restrict network access to the fprime-gds Flask listener so that only authorized operator workstations can reach it, using host firewall rules or a segmented management network
Take the ground station Flask interface offline if it is currently exposed beyond the operator subnet
Audit spacecraft command history and ground station host activity for signs of unauthorized use

Patch Information

At the time of NVD publication on 2026-08-10, no fixed version is referenced in the advisory. Track the NASA fprime-gds repository and the fprime-gds package on PyPI for a release beyond 3.4.3 that introduces authentication on the Flask endpoints.

Workarounds

Place the Flask interface behind a reverse proxy that enforces mutual TLS or HTTP authentication before requests reach fprime-gds
Bind the Flask listener to 127.0.0.1 and require operators to reach it through an authenticated SSH tunnel or VPN
Apply strict firewall rules on the ground station host to allow inbound traffic to the Flask port only from known operator addresses
Disable the Flask interface entirely when it is not required for an active mission phase

bash

# Example: restrict fprime-gds Flask listener to localhost and
# allow only an operator subnet via iptables
iptables -A INPUT -p tcp --dport 5000 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 5000 -j DROP