CVE-2026-72577 describes multiple security flaws in NASA's fprime-gds software up to version 3.4.3. The Flask-based application does not enforce authentication on any endpoint, allowing unauthenticated access. A path traversal vulnerability in the upload/download module permits attackers to read and write files outside the intended directory. Additionally, a hardcoded secret key enables session forgery attacks. Together, these vulnerabilities enable an attacker to achieve arbitrary code execution on the ground station host and inject arbitrary commands to spacecraft connected to the system, resulting in full system compromise.

An unauthenticated remote attacker can fully compromise the ground data system by executing arbitrary code on the host and controlling connected spacecraft. This leads to complete loss of confidentiality, integrity, and availability of the affected system and its mission-critical operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the ground station host and monitor for unauthorized activity. Implement additional authentication controls externally if possible.