# CVE-2026-5473: NASA cFS deserialization in Ground System Pickle Module

Source: https://junglewise.ai/threats/cve-2026-5473-nasa-cfs-deserialization-in-ground-system-pickle-module  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-03. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-5473 · Severity: medium · CVSS 4.5 · Published 2026-04-03

A security vulnerability exists in the NASA Core Flight System (cFS) Ground System, which is used to manage and command spacecraft from Earth. An attacker with local access to the ground station computer could replace command or parameter files with malicious versions. When a mission operator opens these files, the system could execute unauthorized code, potentially leading to a full takeover of the operator's workstation and disruption of mission operations.

Technologies: [Nasa Core Flight System](https://junglewise.ai/threats/technologies/core-flight-system). Vendors: [Nasa](https://junglewise.ai/threats/vendors/nasa).

## Quick answers

**Is CVE-2026-5473 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-5473 being exploited in the wild.

**How severe is CVE-2026-5473?** Medium severity, with a CVSS score of 4.5, published 3 April 2026.

**Which products and versions are affected?** NASA cFS up to 7.0.0.

**Is there a fix for CVE-2026-5473?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-5473 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-5473?** Check whether you run Nasa Core Flight System. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A deserialization vulnerability exists in the NASA cFS Ground System (specifically within the cFS-GroundSystem component) due to the unsafe use of Python's 'pickle.load()' function. The vulnerability is located in 'UdpCommands.py', 'CommandSystem.py', and 'Parameter.py', where the system loads command and parameter definition files from disk without integrity verification. Because the 'pickle' module supports the '__reduce__' protocol, an attacker who can modify '.pickle' files in the 'CommandFiles/' or 'ParameterFiles/' directories can execute arbitrary OS commands with the privileges of the Ground System operator. This requires local access or a prior foothold on the system to modify the files. As of the advisory date, the project has been informed but a formal patch has not been confirmed.

## Affected products

- NASA cFS up to 7.0.0

## Timeline

- 2026-03-18: disclosed: Issue reported on GitHub by 0rbitingZer0
- 2026-04-03: advisory: Vulnerability published in NVD/VulDB

## References

- [https://github.com/nasa/cFS/](https://github.com/nasa/cFS/)
- [https://github.com/nasa/cFS/issues/951](https://github.com/nasa/cFS/issues/951)
- [https://vuldb.com/submit/781949](https://vuldb.com/submit/781949)
- [https://vuldb.com/vuln/355077](https://vuldb.com/vuln/355077)
- [https://vuldb.com/vuln/355077/cti](https://vuldb.com/vuln/355077/cti)

## Related threats

- [NASA cFS integer overflow in CFE_TBL_ValidateCodecLoadSize](https://junglewise.ai/threats/cve-2026-5476-nasa-cfs-integer-overflow-in-cfe-tbl-validatecodecloadsize)
- [NASA cFS memory corruption in CCSDS Header Size Handler](https://junglewise.ai/threats/cve-2026-5475-nasa-cfs-memory-corruption-in-ccsds-header-size-handler)
- [NASA cFS heap buffer overflow in CCSDS Packet Header Handler](https://junglewise.ai/threats/cve-2026-5474-nasa-cfs-heap-buffer-overflow-in-ccsds-packet-header-handler)