CVE-2026-103244: Sgoudelis Ground-Station

Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days.

ground-station versions before 0.8.0 contain an authentication bypass vulnerability in the setup.restore command that allows unauthenticated attackers to execute arbitrary SQL during first-run setup mode. Attackers can invoke setup.restore via Socket.IO to plant admin users and forged session tokens, then authenticate as administrator without credentials for complete application takeover.

Affected products

• Sgoudelis Ground-Station: before 0.8.0 (fixed in 0.8.0)

Published 2026-10-01. Last modified 2026-10-01.