Credential Disclosure in Ground Station by Sgoudelis

CVE-2026-123485

What is CVE-2026-123485?

Ground Station versions from 0.6.0 up to (but not including) 0.8.20 exhibit a flaw where the get-orbital-sources Socket.IO handler is accessible to authenticated operator-role users. This lack of proper access control allows these users to retrieve sensitive plaintext information, including usernames, passwords, and tokens stored by administrators for orbital sources. While the write handlers for orbital sources are limited to admin users, the exposed handlers pose a risk of unauthorized data exposure.

References