CVE-2026-53983 is a critical SSRF vulnerability in Efstratios Goudelis Ground Station before version 0.6.0. An unauthenticated attacker can connect to the Socket.IO server on port 7000, bypassing authentication due to disabled enforcement and a permissive CORS policy. The attacker submits a crafted URL via the data_submission event, which is stored without validation and used in periodic orbital sync tasks. The URL is passed directly to HTTP request functions without scheme or host restrictions, allowing requests to internal services, including cloud instance metadata endpoints. HTTP status codes and error messages are leaked via Socket.IO events, providing an oracle for internal resource probing. The persistent nature of the stored URL enables durable SSRF exploitation without continuous attacker connection.

The vulnerability allows unauthenticated remote attackers to perform blind SSRF attacks, potentially accessing internal network resources or cloud metadata services. The attacker can cause the server to make arbitrary HTTP requests, which may lead to information disclosure or further internal network reconnaissance. The persistence of the malicious URL in the database and its automatic re-execution every 24 hours increases the risk and duration of exploitation. However, raw response bodies are not leaked, limiting direct data exfiltration but still providing useful status and error information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Socket.IO server on port 7000 to trusted clients only and disable or restrict CORS policies to prevent unauthorized connections. Additionally, implement input validation and scheme/host allowlisting on URLs accepted by the data_submission event to prevent injection of malicious URLs. Monitor and remove any attacker-supplied URLs from the database to stop recurring SSRF triggers.