CVE-2026-1579

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-1579
The MAVLink communication protocol does not require cryptographic authentication by default. When MAVLink 2.0 message signing is not enabled, any message -- including SERIAL_CONTROL, which provides interactive shell access -- can be sent by an unauthenticated party with access to the MAVLink interface. PX4 provides MAVLink 2.0 message signing as the cryptographic authentication mechanism for all MAVLink communication. When signing is enabled, unsigned messages are rejected at the protocol level.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://docs.px4.io/main/en/mavlink/message_signing Product
https://docs.px4.io/main/en/mavlink/security_hardening Product
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-090-02.json Third Party Advisory
https://www.cisa.gov/news-events/ics-advisories/icsa-26-090-02 Third Party Advisory US Government Resource
Configurations

Configuration 1 (hide)

cpe:2.3:a:px4:autopilot:1.16.0:-:*:*:*:*:*:*
History

29 Jul 2026, 19:31

Type Values Removed Values Added
CPE cpe:2.3:a:px4:autopilot:1.16.0:*:*:*:*:*:*:* cpe:2.3:a:px4:autopilot:1.16.0:-:*:*:*:*:*:*

24 Jul 2026, 20:10

Type Values Removed Values Added
Summary
  • (es) El protocolo de comunicación MAVLink no requiere autenticación criptográfica por defecto. Cuando la firma de mensajes MAVLink 2.0 no está habilitada, cualquier mensaje -- incluyendo SERIAL_CONTROL, que proporciona acceso interactivo a la shell -- puede ser enviado por una parte no autenticada con acceso a la interfaz MAVLink. PX4 proporciona la firma de mensajes MAVLink 2.0 como el mecanismo de autenticación criptográfica para toda la comunicación MAVLink. Cuando la firma está habilitada, los mensajes no firmados son rechazados a nivel de protocolo.

07 Apr 2026, 15:33

Type Values Removed Values Added
References () https://docs.px4.io/main/en/mavlink/message_signing - () https://docs.px4.io/main/en/mavlink/message_signing - Product
References () https://docs.px4.io/main/en/mavlink/security_hardening - () https://docs.px4.io/main/en/mavlink/security_hardening - Product
References () https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-090-02.json - () https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-090-02.json - Third Party Advisory
References () https://www.cisa.gov/news-events/ics-advisories/icsa-26-090-02 - () https://www.cisa.gov/news-events/ics-advisories/icsa-26-090-02 - Third Party Advisory, US Government Resource
First Time Px4 autopilot
Px4
CPE cpe:2.3:a:px4:autopilot:1.16.0:*:*:*:*:*:*:*

31 Mar 2026, 21:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-31 21:16

Updated : 2026-07-29 19:31

NVD link : CVE-2026-1579

Mitre link : CVE-2026-1579

CVE.ORG link : CVE-2026-1579

JSON object : View

Products Affected

px4

  • autopilot
CWE
CWE-306

Missing Authentication for Critical Function