PT-2026-29340 · Px4 · Autopilot

Dolev Aviv · Published 2026-03-31 · Updated 2026-03-31 · CVE-2026-1579

NVD

CVSS v3.1

9.8

Critical

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The MAVLink communication protocol does not require cryptographic authentication by default. When MAVLink 2.0 message signing is not enabled, any message -- including SERIAL CONTROL, which provides interactive shell access -- can be sent by an unauthenticated party with access to the MAVLink interface. PX4 provides MAVLink 2.0 message signing as the cryptographic authentication mechanism for all MAVLink communication. When signing is enabled, unsigned messages are rejected at the protocol level.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-1579

Affected Products

Autopilot

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-1579 · Security Note
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-090-02.json · Note
• https://docs.px4.io/main/en/mavlink/message_signing · Note
• https://docs.px4.io/main/en/mavlink/security_hardening · Note
• https://cisa.gov/news-events/ics-advisories/icsa-26-090-02 · Note