CVE-2026-123485 · Package
NO FIX YET · SEE WHAT TO DO
Ground Station versions from 0.6.0 before 0.8.20 let a user with the operator role call the get-orbital-sources or get-tle-sources Socket.IO handlers, which are meant for administrators only. Those handlers return the plaintext usernames, passwords and tokens that administrators stored for orbital sources.
first public Oct 22, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Deployments running Ground Station from 0.6.0 up to but not including 0.8.20 that have operator-role accounts and orbital sources configured with basic or token credentials. Installations on 0.8.20 or later, or with no operator users, are not exposed through this path.
Not affected if no-operator-users, no-stored-source-credentials, version-0.8.20-or-later
Who cares ground-station, self-hosted, socket.io
0.8.200.8.20 or laterGround Station from 0.6.0 before 0.8.20 does not restrict the get-orbital-sources Socket.IO handler (also exposed as get-tle-sources) to administrators, although the orbital-source write handlers are admin-only. An authenticated operator-role user can call either handler to retrieve the plaintext usernames, passwords, and tokens that administrators stored for basic and token orbital sources.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.