CVE-2026-32713 - Vulnerability Analysis

Overview

PX4 autopilot < 1.17.0-rc2 contains a broken access control vulnerability caused by incorrect boolean logic in MAVLink FTP session validation, letting unauthenticated attackers bypass session isolation and trigger invalid file operations.

Severity & Score

Impact

Unauthenticated attackers can bypass session isolation and cause inconsistent FTP subsystem state, potentially disrupting drone control or data integrity.

Mitigation

Update to version 1.17.0-rc2 or later.

References

• https://github.com/PX4/PX4-Autopilot/security/advisories/GHSA-pp2c-jr5g-6f2m

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner