NVD CRITICAL: CVE-2026-103244 — ground-station versions before 0.8.0 contain an authentication bypass vulnerabil...

Thursday, October 1, 2026 at 11:17 AM UTC·Source: NIST NVD

Updated: Thursday, October 1, 2026 at 12:00 PM UTC

Executive Summary

ground-station versions before 0.8.0 contain an authentication bypass vulnerability in the setup.restore command that allows unauthenticated attackers to execute arbitrary SQL during first-run setup mode. Attackers can invoke setup.restore via Socket.IO to plant admin users and forged session tokens, then authenticate as administrator without credentials for complete application takeover.

Analysis

Indicators of Compromise (1)

CVE (1)

CVE-2026-103244

NVD MITRE CVE

Source Attribution

Originally published by NIST NVD on Oct 1, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

US sanctions Tren de Aragua gang members in ATM hacks crackdown

The U.S. Treasury Department has sanctioned eight members of the Venezuelan gang Tren de Aragua (TdA) for their role in the theft of millions of dollars in ATM jackpotting attacks across the United States. [...]

51m agoBleepingComputer

MEDIUMVulnerabilityNEW

YouTuber raises $15m for Brazil's 'Cash App'

NG.Cash, the "Brazilian Cash App" founded by a former YouTuber, has raised $15 million to back its efforts to bring credit and crypto services to the country's young, unbanked population.

57m agoFinextra

MEDIUMVulnerability

Unidentified Flock Cameras in Florida

St. Lucie County in Florida discovered ( alt link ) a dozen Flock cameras whose ownership it can’t identify, and that the county government had not permitted. I am reminded of the decade-old story of StingRay cell phone surveillance devices in Washington, DC, whose operators were also unknown. My guess is that in the StingRay case, the devices were operated by foreign actors. This Flock case

1h agoSchneier on Security