{"id":"CVE-2026-123485","kind":"vulnerability","aliases":["CVE-2026-123485"],"related":[],"title":"Ground Station: operator users can read orbital source credentials","description":"Ground Station from 0.6.0 before 0.8.20 does not restrict the get-orbital-sources Socket.IO handler (also exposed as get-tle-sources) to administrators, although the orbital-source write handlers are admin-only. An authenticated operator-role user can call either handler to retrieve the plaintext usernames, passwords, and tokens that administrators stored for basic and token orbital sources.","summary":"Ground Station versions from 0.6.0 before 0.8.20 let a user with the operator role call the get-orbital-sources or get-tle-sources Socket.IO handlers, which are meant for administrators only. Those handlers return the plaintext usernames, passwords and tokens that administrators stored for orbital sources.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ground-station","package","self-hosted","socket.io"],"not_affected_if":["no-operator-users","no-stored-source-credentials","version-0.8.20-or-later"],"how_to_check":"- Check the installed Ground Station version and see whether it is below `0.8.20`\n- Review which accounts hold the operator role and whether any are untrusted","fix":"- Ground Station: move to `0.8.20` or later","status":"open","published_at":"2026-11-06T15:17:17+00:00","first_seen_at":"2026-11-06T15:42:43+00:00","triaged_at":"2026-11-06T15:44:19+00:00","updated_at":"2026-11-06T15:44:19+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-06T15:44:19Z","model":"claude-haiku-5-5","output":{"fix":"- Ground Station: move to `0.8.20` or later","reach":"network","title":"Ground Station: operator users can read orbital source credentials","impact":"medium","summary":"Ground Station versions from 0.6.0 before 0.8.20 let a user with the operator role call the get-orbital-sources or get-tle-sources Socket.IO handlers, which are meant for administrators only. Those handlers return the plaintext usernames, passwords and tokens that administrators stored for orbital sources.","audience":"businesses","category":"package","nicknames":[],"who_cares":["ground-station","self-hosted","socket.io"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"operator user reads stored orbital source passwords and tokens","analyst_note":"","how_to_check":"- Check the installed Ground Station version and see whether it is below `0.8.20`\n- Review which accounts hold the operator role and whether any are untrusted","plain_action":"","needs_analyst":false,"not_affected_if":["version-0.8.20-or-later","no-operator-users","no-stored-source-credentials"],"who_is_affected":"Deployments running Ground Station from 0.6.0 up to but not including 0.8.20 that have operator-role accounts and orbital sources configured with basic or token credentials. Installations on 0.8.20 or later, or with no operator users, are not exposed through this path.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000691,"input_tokens":4309,"output_tokens":520,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123485':12A,15A '-2026':11A,14A '0.6.0':28B,75C '0.8.20':30B,77C 'admin':106C 'admin-on':105C 'administr':55B,67B,96C,127C 'also':88C 'although':97C 'authent':109C 'basic':130C 'call':38B,115C 'credenti':9A 'cve':10A,13A 'either':116C 'expos':89C 'get':41B,46B,83C,92C 'get-orbital-sourc':40B,82C 'get-tle-sourc':45B,91C 'ground':1A,17B,24B,72C 'ground-stat':16B 'handler':50B,58B,87C,103C,117C 'host':22B 'let':31B 'meant':53B 'oper':3A,36B,111C 'operator-rol':110C 'orbit':7A,42B,70B,84C,100C,133C 'orbital-sourc':99C 'packag':19B 'password':63B,123C 'plaintext':61B,121C 'read':6A 'restrict':80C 'retriev':119C 'return':59B 'role':37B,112C 'self':21B 'self-host':20B 'socket.io':23B,49B,86C 'sourc':8A,43B,48B,71B,85C,94C,101C,134C 'station':2A,18B,25B,73C 'store':68B,128C 'tle':47B,93C 'token':65B,125C,132C 'user':4A,33B,113C 'usernam':62B,122C 'version':26B 'write':102C","nicknames":[],"mitigations":[],"who_affected":"Deployments running Ground Station from 0.6.0 up to but not including 0.8.20 that have operator-role accounts and orbital sources configured with basic or token credentials. Installations on 0.8.20 or later, or with no operator users, are not exposed through this path.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["groundstation","high","package","selfhosted","socketio"],"campaign_type":null,"search_a":"'-123485':12A,15A '-2026':11A,14A 'credenti':9A 'cve':10A,13A 'ground':1A 'oper':3A 'orbit':7A 'read':6A 'sourc':8A 'station':2A 'user':4A","search_b":"'0.6.0':28B '0.8.20':30B 'administr':55B,67B 'call':38B 'get':41B,46B 'get-orbital-sourc':40B 'get-tle-sourc':45B 'ground':17B,24B 'ground-stat':16B 'handler':50B,58B 'host':22B 'let':31B 'meant':53B 'oper':36B 'orbit':42B,70B 'packag':19B 'password':63B 'plaintext':61B 'return':59B 'role':37B 'self':21B 'self-host':20B 'socket.io':23B,49B 'sourc':43B,48B,71B 'station':18B,25B 'store':68B 'tle':47B 'token':65B 'user':33B 'usernam':62B 'version':26B","search_c":"'0.6.0':75C '0.8.20':77C 'admin':106C 'admin-on':105C 'administr':96C,127C 'also':88C 'although':97C 'authent':109C 'basic':130C 'call':115C 'either':116C 'expos':89C 'get':83C,92C 'get-orbital-sourc':82C 'get-tle-sourc':91C 'ground':72C 'handler':87C,103C,117C 'oper':111C 'operator-rol':110C 'orbit':84C,100C,133C 'orbital-sourc':99C 'password':123C 'plaintext':121C 'restrict':80C 'retriev':119C 'role':112C 'socket.io':86C 'sourc':85C,94C,101C,134C 'station':73C 'store':128C 'tle':93C 'token':125C,132C 'user':113C 'usernam':122C 'write':102C","first_public_at":"2026-10-22T07:44:36+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123485","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123485","severity":null,"published_at":"2026-11-06T15:17:17+00:00","modified_at":"2026-11-06T15:17:17+00:00","first_seen_at":"2026-11-06T15:42:43+00:00","fetched_at":"2026-11-06T15:42:43+00:00","note":null}],"documents":[{"id":87550,"url":"https://github.com/sgoudelis/ground-station/security/advisories/GHSA-ff27-5cfv-jh69","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-22T07:44:36+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":87551,"url":"https://www.vulncheck.com/advisories/ground-station-0.6.0-before-0.8.20-credential-disclosure-via-get-orbital-sources","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}