PT-2026-29340 · Unknown · Px4-Autopilot

Dolev Aviv · Published 2026-03-31 · Updated 2026-04-15 · CVE-2026-1579

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PX4 Autopilot (affected versions not specified)

Description The MAVLink communication protocol, as used by PX4 Autopilot, does not require cryptographic authentication by default. Without MAVLink 2.0 message signing enabled, unauthenticated parties with access to the MAVLink interface can send messages, including the SERIAL CONTROL message which provides interactive shell access. Enabling MAVLink 2.0 message signing in PX4 provides cryptographic authentication and rejects unsigned messages at the protocol level. The SERIAL CONTROL message allows for remote shell access.

Recommendations Enable MAVLink 2.0 message signing to provide cryptographic authentication for all MAVLink communication.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-1579

Affected Products

Px4-Autopilot

References · 17

• https://nvd.nist.gov/vuln/detail/CVE-2026-1579 · Security Note
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-090-02.json · Note
• https://twitter.com/syedaquib77/status/2039622527098462217 · Twitter Post
• https://twitter.com/CosmicBytez/status/2039451437231747180 · Twitter Post
• https://twitter.com/SecurityAr58409/status/2044263007555895396 · Twitter Post
• https://twitter.com/CVEnew/status/2039372135009783884 · Twitter Post
• https://twitter.com/ZeitTrender/status/2041332067934572635 · Twitter Post
• https://twitter.com/0dayPublishing/status/2039076357657760179 · Twitter Post
• https://twitter.com/aviatrixtrc/status/2039385334119579916 · Twitter Post
• https://twitter.com/the_yellow_fall/status/2039370955831841087 · Twitter Post
• https://cisa.gov/news-events/ics-advisories/icsa-26-090-02 · Note
• https://docs.px4.io/main/en/mavlink/security_hardening · Note
• https://twitter.com/CveFindCom/status/2039096059931083129 · Twitter Post
• https://twitter.com/TheHackerWire/status/2039200681563992366 · Twitter Post
• https://twitter.com/threatcluster/status/2039651650864865659 · Twitter Post