CVE-2026-1579

PX4 Autopilot Missing authentication for critical function

CVSS 9.3 CRITICALEPSS 0.9%CWE-306

Vexday Risk Score

28Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 9.3EPSS 0.9%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

31 Mar 2026Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

The MAVLink communication protocol does not require cryptographic authentication by default. When MAVLink 2.0 message signing is not enabled, any message -- including SERIAL_CONTROL, which provides interactive shell access -- can be sent by an unauthenticated party with access to the MAVLink interface. PX4 provides MAVLink 2.0 message signing as the cryptographic authentication mechanism for all MAVLink communication. When signing is enabled, unsigned messages are rejected at the protocol level.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected products

PX4 · Autopilot

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://docs.px4.io/main/en/mavlink/message_signing https://docs.px4.io/main/en/mavlink/security_hardening https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-090-02.json https://www.cisa.gov/news-events/ics-advisories/icsa-26-090-02