CVE-2026-1579

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-1579
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-1579.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-1579
Published
2026-03-31T20:20:06.506Z
Modified
2026-07-31T03:48:42.466339896Z
Severity
  • 9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
PX4 Autopilot Missing authentication for critical function
Details

The MAVLink communication protocol does not require cryptographic authentication by default. When MAVLink 2.0 message signing is not enabled, any message -- including SERIAL_CONTROL, which provides interactive shell access -- can be sent by an unauthenticated party with access to the MAVLink interface. PX4 provides MAVLink 2.0 message signing as the cryptographic authentication mechanism for all MAVLink communication. When signing is enabled, unsigned messages are rejected at the protocol level.

Database specific 
{
    "cwe_ids": [
        "CWE-306"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/1xxx/CVE-2026-1579.json",
    "cna_assigner": "icscert",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "v1.16.0 SITL"
                },
                {
                    "last_affected": "v1.16.0 SITL"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/px4/px4-autopilot

Affected ranges

Type
GIT
Repo
https://github.com/px4/px4-autopilot
Events
Introduced
6ea3539157ca358c70a515878b77077af7d4611d
Last affected
6ea3539157ca358c70a515878b77077af7d4611d
Database specific 
{
    "cpe": "cpe:2.3:a:px4:autopilot:1.16.0:-:*:*:*:*:*:*",
    "source": "CPE_STRING",
    "extracted_events": [
        {
            "introduced": "1.16.0-NA"
        },
        {
            "last_affected": "1.16.0-NA"
        }
    ]
}

Affected versions

1.*
1.16.0-NA
v1.*
v1.16.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-1579.json"