A critical vulnerability in NASA’s fprime-gds ground-station software could allow an unauthenticated remote attacker to execute code on the system running it and potentially issue commands to a connected spacecraft.
The security bug, tracked as CVE-2026-72577, was first reported Monday and impacts NASA-developed ground-station software. The flaw that carries a CVSS score of 9.8, and could allow a remote attacker to take control of the computer running it and potentially send commands to a connected spacecraft.
Versions of fprime-gds through 3.4.3 are reported to be affected. Most likely impacted are the small number of NASA/JPL small-mission programs and university-run CubeSat labs running the impacted Python-based ground data system.
The issue affects fprime-gds, the ground-control software that accompanies NASA’s open-source F´ spacecraft software framework. F´ is used to build and operate spacecraft systems, while fprime-gds gives engineers a dashboard for monitoring telemetry, reviewing events and sending commands.
There is no indication so far that attackers are exploiting the flaw in the wild, and no public exploit has surfaced. NASA also has not published a formal security advisory for the finding. Security Point Break could not confirm that a patched version is available.
The Problem is Basic
The web interface used by fprime-gds does not require users to authenticate before accessing its functions. In other words, anyone on the network can attack it easily. An adversary does not need an account to achieve full read/write/control privileges over the system.
Because the vulnerability sits in the ground station software rather than the spacecraft itself, the direct exposure is to whatever computer is running fprime-gds. That machine is also the one issuing commands, so a compromise there gives an attacker a path to the connected spacecraft. Given F´’s user base, a typical target might include CubeSats, SmallSats and university-run ground stations rather than flagship NASA missions.
Past use of F´ has included use aboard NASA’s Ingenuity Mars Helicopter, the International Space Station’s RapidScat instrument and JPL’s ASTERIA CubeSat. It has also been selected for other NASA and university spacecraft projects.
Researchers also identified a path traversal weakness in the software’s file-transfer functionality. Path traversal bugs can allow attackers to reach files or locations on a computer that the application was never supposed to give them access to.
Combined, the flaws could allow an attacker to upload or manipulate files, execute code on the ground-station computer and use the software’s command interface to issue instructions to whatever F´-based system is connected to it.
That means organizations running fprime-gds should not assume an update will protect them yet. The immediate defense is making sure the software cannot be reached from untrusted networks.
The risk does not mean someone can simply connect to NASA over the internet and start steering spacecraft.
fprime-gds is generally intended to operate inside isolated development labs, testing environments and mission networks rather than as a public-facing internet service. An attacker would first need network access to a system running the software.
But closed networks are not necessarily safe networks. A compromised workstation, university lab, shared testing environment or improperly exposed server could give an attacker the foothold needed to reach the ground-control application.
And the software sits in a sensitive position.
Past Problems with fprime-gds
The newly reported flaw is separate from another collection of fprime-gds vulnerabilities disclosed by VisionSpace researchers in March 2025.
Those researchers found problems including cross-site scripting, template injection, a denial-of-service vulnerability and a potential route to remote code execution involving unencrypted communications between flight software and the ground system, according to VisionSpace’s published research.
The new finding instead focuses on the fprime-gds web application itself and its lack of authentication and weaknesses in how it handles files and commands.
Ground-control software has traditionally been protected by the assumption that only trusted people on trusted networks can reach it. The fprime-gds findings show what happens when software built around that assumption suddenly becomes reachable by someone who should not be there.
Image by WikiImages from Pixabay
