CVE-2026-1579 Details
Description
The MAVLink communication protocol does not require cryptographic authentication by default. When MAVLink 2.0 message signing is not enabled, any message -- including SERIAL_CONTROL, which provides interactive shell access -- can be sent by an unauthenticated party with access to the MAVLink interface. PX4 provides MAVLink 2.0 message signing as the cryptographic authentication mechanism for all MAVLink communication. When signing is enabled, unsigned messages are rejected at the protocol level.
A vulnerability exists in the PX4 Autopilot MAVLink communication protocol, specifically in versions through 1.16.0. The issue arises because MAVLink 2.0 message signing, which provides cryptographic authentication, is disabled by default. Without this signing, any message can be sent by an unauthenticated party with access to the MAVLink interface. This includes the SERIAL_CONTROL message, which grants interactive shell access. When MAVLink 2.0 signing is enabled, unsigned messages are rejected, but this vulnerability allows for unauthorized command execution via the MAVLink interface.
Users are advised to enable MAVLink message signing to authenticate all communications. This can be done by provisioning a secret key via a USB connection and setting the MAV_SIGN_CFG parameter to 1 or 2, depending on the desired signing mode. After provisioning the key, it should be verified that unsigned messages from unknown sources are rejected.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 31, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://docs.px4.io/main/en/mavlink/message_signing | [email protected] | Product |
| https://docs.px4.io/main/en/mavlink/security_hardening | [email protected] | Product |
| https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-090-02.json | [email protected] | Third Party Advisory |
| https://www.cisa.gov/news-events/ics-advisories/icsa-26-090-02 | [email protected] | Third Party AdvisoryUS Government Resource |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| px4 autopilot | 1.16.0 - |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 29, 2026 | Modified Analysis | [email protected] |
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 7, 2026 | Initial Analysis | [email protected] |
| Mar 31, 2026 | New CVE Received | [email protected] |