CVE-2026-19918 is an access control vulnerability in the get_status function of the gRPC Management Interface on SpaceX Starlink Router Gen 3 version 2025.11.14.mr64708.3. The flaw allows an attacker with local network access to improperly access functionality that should be restricted. The vulnerability is classified under CWE-266 (Improper Access Control). The vendor was notified but did not respond, and no official fix or patch has been published. The vulnerability has a CVSS 3.1 base score of 6.3, indicating a medium severity level with local attack vector, low attack complexity, no privileges required, no user interaction, and impacts confidentiality, integrity, and availability to a low degree.

An attacker on the local network can exploit this vulnerability to bypass access controls on the gRPC Management Interface's get_status function, potentially leading to unauthorized information disclosure, modification, or disruption of service. The impact is limited to local network access and is rated as low severity by the source data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, network segmentation and restricting local network access to the router's management interface are recommended as interim mitigations.