The MAVLink communication protocol does not require cryptographic
authentication by default. When MAVLink 2.0 message signing is not
enabled, any message -- including SERIAL_CONTROL, which provides
interactive shell access -- can be sent by an unauthenticated party with
access to the MAVLink interface. PX4 provides MAVLink 2.0 message
signing as the cryptographic authentication mechanism for all MAVLink
communication. When signing is enabled, unsigned messages are rejected
at the protocol level.
References
| Link | Resource |
|---|---|
| https://docs.px4.io/main/en/mavlink/message_signing | Product |
| https://docs.px4.io/main/en/mavlink/security_hardening | Product |
| https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-090-02.json | Third Party Advisory |
| https://www.cisa.gov/news-events/ics-advisories/icsa-26-090-02 | Third Party Advisory US Government Resource |
Configurations
History
07 Apr 2026, 15:33
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Px4 autopilot
Px4 |
|
| CPE | cpe:2.3:a:px4:autopilot:1.16.0:*:*:*:*:*:*:* | |
| References | () https://docs.px4.io/main/en/mavlink/message_signing - Product | |
| References | () https://docs.px4.io/main/en/mavlink/security_hardening - Product | |
| References | () https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-090-02.json - Third Party Advisory | |
| References | () https://www.cisa.gov/news-events/ics-advisories/icsa-26-090-02 - Third Party Advisory, US Government Resource |
31 Mar 2026, 21:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-03-31 21:16
Updated : 2026-04-07 15:33
NVD link : CVE-2026-1579
Mitre link : CVE-2026-1579
CVE.ORG link : CVE-2026-1579
JSON object : View
Products Affected
px4
- autopilot
CWE
CWE-306
Missing Authentication for Critical Function