CVE-2026-1579 - Vulnerability Analysis

Overview

PX4 MAVLink communication protocol without MAVLink 2.0 message signing contains an authentication bypass caused by lack of cryptographic authentication, letting unauthenticated attackers send arbitrary messages including SERIAL_CONTROL, exploit requires MAVLink 2.0 message signing to be disabled.

Severity & Score

Impact

Unauthenticated attackers can send arbitrary commands including interactive shell access, potentially leading to full system compromise.

Mitigation

Enable MAVLink 2.0 message signing or update to the latest version with signing enabled.

References

• https://docs.px4.io/main/en/mavlink/message_signing
• https://docs.px4.io/main/en/mavlink/security_hardening
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-090-02.json
• https://www.cisa.gov/news-events/ics-advisories/icsa-26-090-02

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner