CVE-2026-53983 is a critical SSRF vulnerability in Efstratios Goudelis Ground Station before version 0.6.0. An unauthenticated attacker can connect to the Socket.IO server on port 7000 without credentials due to disabled authentication and a wildcard CORS policy. The attacker submits a crafted URL via a data_submission event, which is stored in the database without scheme or host validation, including loopback and link-local addresses such as cloud instance metadata endpoints. This URL is then used in scheduled orbital sync tasks that issue HTTP requests to the attacker-controlled or internal addresses. The server emits HTTP status codes and error messages to all connected clients, providing an oracle for internal resource probing. The malicious URL persists across restarts and triggers every 24 hours, enabling durable SSRF exploitation without continuous attacker presence.

The vulnerability allows unauthenticated remote attackers to induce the Ground Station server to make arbitrary HTTP requests to internal or external systems, including sensitive cloud metadata services. This can lead to information disclosure about internal network resources and potentially facilitate further attacks. The persistent nature of the stored malicious URL means the SSRF can be exploited repeatedly without attacker interaction after initial injection.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Socket.IO server on port 7000 to trusted clients only, disable or properly configure CORS policies, and implement strict validation and allowlisting of URLs accepted by the orbital-source configuration path to prevent SSRF. Monitor for unusual outbound requests originating from the Ground Station server.