Ground Station <= 0.5.x: Critical Unauthenticated Database Destruction Vulnerability
An unauthenticated database-destruction and arbitrary-data-injection vulnerability has been reported in Ground Station versions prior to 0.6.0. This vulnerability could allow an unauthenticated network peer to wipe or replace the entire SQLite database.
What happened
Ground Station versions prior to 0.6.0 reportedly contain a critical vulnerability in the Socket.IO server's database_backup event handler. This vulnerability, tracked as CVE-2026-53984 with a CVSS score of 9.1, allows any unauthenticated network peer to send a full_restore command with a caller-supplied SQL blob, potentially wiping or replacing the entire SQLite database.
The vulnerability is due to disabled authentication enforcement and a wildcard CORS policy on the Socket.IO server, which listens on port 7000. An attacker can connect without credentials, emit the database_backup event, and execute raw SQL commands to drop existing tables and recreate the database with attacker-controlled statements. This could result in the permanent destruction of all satellite records, orbital sources, hardware configurations, and observation schedules, or the injection of fabricated data.
To assess your exposure, check if your Ground Station deployment is running a version prior to 0.6.0. If so, it is recommended to upgrade to Ground Station 0.6.0 or later to mitigate the vulnerability. For more detailed information, consult the primary sources linked in the threat data.
How 0Day mitigates this
ground-station is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.