Is CVE-2026-53983 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-53983 being exploited in the wild.

How severe is CVE-2026-53983?

High severity, with a CVSS score of 8.6, published 6 August 2026.

Which products and versions are affected?

Sgoudelis Ground Station prior to 0.6.0.

Is there a fix for CVE-2026-53983?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-53983 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-53983?

Check whether you run Sgoudelis Ground Station at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-53983: Ground Station unauthenticated SSRF in orbital source configuration

CVE-2026-53983 · Severity: high · CVSS 8.6 · Published 2026-08-06

Ground Station is a browser-based satellite tracking and telemetry decoding application. An unauthenticated attacker can connect to the application's Socket.IO server without credentials, submit a malicious orbital data source URL, and trigger it to issue arbitrary outbound HTTP requests to internal networks or cloud metadata services. The attacker can infer the results through HTTP status codes in error messages, potentially exposing sensitive internal service information or cloud credentials that persist across service restarts.

Technologies: Sgoudelis Ground Station. Vendors: Sgoudelis.

Quick answers

Is CVE-2026-53983 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-53983 being exploited in the wild.
How severe is CVE-2026-53983?: High severity, with a CVSS score of 8.6, published 6 August 2026.
Which products and versions are affected?: Sgoudelis Ground Station prior to 0.6.0.
Is there a fix for CVE-2026-53983?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-53983 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-53983?: Check whether you run Sgoudelis Ground Station at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Ground Station versions before 0.6.0 contain an unauthenticated server-side request forgery (SSRF) vulnerability in the orbital-source configuration handling. The root cause is that Socket.IO authentication is disabled and the application accepts unauthenticated data_submission events with submit-orbital-sources actions that store arbitrary URLs in the database without validation (no scheme allowlist, host validation, or rejection of loopback/RFC1918/link-local addresses). An unauthenticated network attacker can persist a malicious URL in the database by connecting to port 7000, then trigger orbital sync via background_task:start to cause the backend to issue requests.get() calls to attacker-chosen destinations in backend/tlesync/source_adapters.py (_fetch_http_3le and _fetch_http_omm). HTTP status codes and error messages are leaked via orbital_sync_state Socket.IO events to all clients, providing an oracle for interpreting responses from internal services and cloud metadata endpoints (e.g., 169.254.169.254). Because the malicious source persists across restarts and re-fires every 24 hours, the attacker achieves durable SSRF without maintaining a connection. The vulnerability is fixed in version 0.6.0 or later.

Affected products

sgoudelis Ground Station prior to 0.6.0

Timeline

2026-08-06: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.