CVE-2026-103244

Critical

Description

ground-station versions before 0.8.0 contain an authentication bypass vulnerability in the setup.restore command that allows unauthenticated attackers to execute arbitrary SQL during first-run setup mode. Attackers can invoke setup.restore via Socket.IO to plant admin users and forged session tokens, then authenticate as administrator without credentials for complete application takeover.

SeverityCritical

CVSS9.8

Exploit probability—

ProductSgoudelis Ground-station

PublishedOct 1, 2026

First seenOct 1, 2026

Weakness typeCWE-306Missing authentication for critical function

How to fix

Update

sgoudelis ground-station0.8.0 or later

Patches

github.com/sgoudelis/ground-station/commit/940df2128e57fa779d0ddee2d9726bd829fc61e1

Vendor advisories

github.com/sgoudelis/ground-station/security/advisories/GHSA-3mqj-q84c-crjq

Affected products

Product	Affected versions	Fixed in
sgoudelis ground-station	v < 0.8.0	0.8.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.