CVE-2026-72577 is a critical vulnerability in NASA's fprime-gds software (versions before 3.4.4) where the Flask-based web application does not apply any authentication to its endpoints. This missing authentication (CWE-306) enables unauthenticated remote attackers to achieve arbitrary code execution on the ground station host and inject commands to spacecraft connected to the system. The vulnerability has a CVSS 3.1 score of 9.8, indicating high impact on confidentiality, integrity, and availability. No official patch or remediation level has been published yet.

Successful exploitation allows an unauthenticated attacker to execute arbitrary code on the ground station host, potentially compromising the entire ground control environment. Additionally, attackers can inject arbitrary commands to spacecraft, posing severe risks to mission operations and spacecraft safety. The vulnerability affects confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the fprime-gds Flask application to trusted users only, and consider deploying network-level controls or authentication proxies to mitigate unauthorized access.