CVE-2026-53983

The CVE concerns Ground Station prior to 0.6.0, exposing an unauthenticated blind SSRF via the orbital-source URL path. An unauthenticated Socket.IO client can connect on port 7000 (credentials not required, wildcard CORS) and submit a data_submission with submit-orbital-sources to store an attac...