External risk intelligence

NASA fprime-gds Unauthenticated Code Execution and Command Injection Vulnerabilities.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-72577

The vulnerable component is a ground data system (GDS) used to interact with spacecraft. While it uses a web-based interface (Flask) and network connectivity, such systems are typically operated within highly controlled, internal, or mission-specific network environments rather than being exposed directly to the public internet in common deployment patterns.

Missing Authentication

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in NASA's ground data system (fprime-gds), a system used to control spacecraft. This issue, if exploited, could allow an unauthorized remote attacker to take full control of the ground system and any connected spacecraft. The main concern is confirming the relevance and exposure of this system within our operations.

Unauthenticated remote code execution in a spacecraft control system.
Confirms potential for mission-critical system compromise.
Verify relevance and exposure of ground data systems.

Attack Path

How an attacker could exploit the issue

An attacker could target the ground data system's web interface, which lacks authentication, to access its features. By exploiting a flaw allowing them to read and write files, combined with a predictable secret key for session manipulation, an attacker can gain control over the system and any connected spacecraft.

Unauthenticated remote network access.
Triggered by interacting with web endpoints.
Arbitrary code execution and command injection.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated attacker could execute arbitrary code on a ground station host and inject commands into connected spacecraft, leading to a complete compromise of the ground data system and any spacecraft it controls, when supported by the advisory's conditions.

Ground system and connected spacecraft.
Network access and unauthenticated endpoints.
Complete system compromise and command injection.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability impacts NASA's fprime-gds, potentially leading to complete compromise of the ground data system and connected spacecraft. Immediate action is required to identify all instances of fprime-gds, determine their network exposure and criticality, and locate the accountable system owners. A risk-based remediation plan, which may involve vendor coordination or temporary risk reduction, should then be developed and executed.

Ownership: Ground system or application owners.
Verify first: System exposure and criticality.
Action: Plan coordinated remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is NASA fprime-gds?

NASA fprime-gds is a Ground Data System (GDS) application. It acts as the mission control software, providing a web-based interface that engineers use to communicate with, monitor, and send commands to spacecraft. It is a core component within the F' (F-prime) framework, which is designed for building flight software and the ground systems that support them.

What does CWE-306 mean for CVE-2026-72577?

CWE-306 refers to a Missing Authentication for Critical Function weakness. In the context of CVE-2026-72577, this means the software's web interface allows users to perform sensitive actions—like executing code on the host or sending commands to spacecraft—without verifying who they are. Because the application lacks these checks, any remote user who can reach the web interface can interact with it as if they were a trusted operator.

How can an attacker trigger this vulnerability?

An attacker triggers this by interacting directly with the web endpoints provided by the application. Because there is no authentication, simply sending requests to the software's interface is sufficient. Note that this does not require complex prior access; however, the attack relies on the absence of access controls, meaning local configuration settings that restrict network access might prevent an external attacker from reaching these endpoints in the first place.

Is my system at risk if it is not on the public internet?

According to Halo Surface Signal, this software is typically used in highly controlled or mission-specific internal network environments. While the vulnerability is technically network-accessible, the practical risk often depends on whether your GDS deployment is isolated from broader corporate or public networks. You should prioritize assessing systems that are reachable beyond your most secure, restricted zones.

What steps should I take if I use fprime-gds?

First, identify all instances of fprime-gds currently running in your environment to understand your footprint. Once mapped, evaluate the network placement and criticality of each instance to determine which systems are most exposed. Consult with your system owners to develop a remediation plan, which should prioritize restricting unauthorized access or implementing compensating controls while you coordinate a permanent fix.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.