CVE-2026-1579

CRITICAL 9.8

PX4 Autopilot Missing authentication for critical function

CVSS Score

9.8

EPSS Score

0.0%

EPSS Percentile

0th

The MAVLink communication protocol does not require cryptographic authentication by default. When MAVLink 2.0 message signing is not enabled, any message -- including SERIAL_CONTROL, which provides interactive shell access -- can be sent by an unauthenticated party with access to the MAVLink interface. PX4 provides MAVLink 2.0 message signing as the cryptographic authentication mechanism for all MAVLink communication. When signing is enabled, unsigned messages are rejected at the protocol level.

CWE	CWE-306
Vendor	px4
Product	autopilot
Published	Mar 31, 2026
Last Updated	Mar 31, 2026

Stay Ahead of the Next One

Get instant alerts for px4 autopilot

Be the first to know when new critical vulnerabilities affecting px4 autopilot are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

PX4 / Autopilot

v1.16.0 SITL

References

NVD ↗ CVE.org ↗ EPSS Data ↗

docs.px4.io: https://docs.px4.io/main/en/mavlink/security_hardening docs.px4.io: https://docs.px4.io/main/en/mavlink/message_signing cisa.gov: https://www.cisa.gov/news-events/ics-advisories/icsa-26-090-02 github.com: https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-090-02.json

Credits

Dolev Aviv of Cyviation reported this vulnerability to CISA.