External risk intelligence

Ground-Station Authentication Bypass via SQL Injection

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-103244

The vulnerability exists specifically within the first-run setup mode of the application. While the service may be network-reachable, the setup process is typically performed during initial deployment and is not a standard, ongoing internet-facing interface in most common production environments.

Missing Authentication

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security vulnerability has been identified in ground-station software that could allow unauthorized individuals to gain administrative access and take over the application during its initial setup. This issue is related to how the software handles authentication when it is first configured.

Allows takeover during initial setup.
Critical access flaw; requires review.
Assess impact and confirm relevance.

Attack Path

How an attacker could exploit the issue

An attacker could reach the vulnerable component by sending specific commands over the network to the application during its initial setup phase. This allows them to bypass authentication, execute arbitrary SQL commands, and gain administrative control.

No authentication is required.
Triggered via Socket.IO during first-run setup.
Results in full application takeover.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to bypass authentication during the initial setup phase, leading to unauthorized administrator access and potential application takeover. This occurs by exploiting the `setup.restore` command via Socket.IO.

Application control is at risk.
Attackers can plant admin users and tokens.
Complete application takeover is possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

The ground-station application's setup process is vulnerable to authentication bypass, allowing attackers to gain administrative access. Application owners or platform teams are likely responsible for managing this technology. The immediate priority is to identify all instances of the ground-station application, determine if they are accessible externally or critical to operations, and confirm the accountable owner before planning remediation.

Identify affected ground-station instances.
Verify external reachability and business criticality.
Plan remediation with the accountable owner.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is ground-station software used for?

Ground-station is a software application designed for infrastructure management and operational control. It provides a centralized interface for configuring, monitoring, and maintaining systems. Because it handles sensitive administrative functions, the application requires secure authentication to protect its core operations from unauthorized access.

What does this authentication bypass mean?

This vulnerability, classified as CWE-306 (Missing Authentication for Critical Function), means the software fails to verify user identity for the setup.restore command. By skipping this check, the application allows unauthorized parties to perform sensitive actions—specifically running arbitrary SQL commands—that should be restricted to authenticated administrators.

How is this vulnerability triggered?

An attacker triggers this by sending malicious messages to the Socket.IO interface while the application is in its initial first-run setup mode. It is important to note that normal application usage after the initial setup process has been completed does not invoke this specific command, nor does it provide the same path to bypass authentication.

Do I need to worry if my instance is not exposed?

Halo Surface Signal notes that this vulnerability is unlikely to be a high priority if your ground-station instances are not internet-facing. Because the flaw is tied to the first-run setup mode—a phase typically completed during initial deployment—the risk is significantly lower for applications that have already moved past the installation and configuration stage.

What should I do to respond to CVE-2026-103244?

First, conduct an inventory to locate all active ground-station deployments within your environment. Verify whether these instances have completed their initial setup or are still in a configuration state. If you are running a version earlier than 0.8.0, coordinate with your technical team to update the software to a patched version as soon as possible.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.