NASA Software: Five Vulnerabilities Including SSRF and Buffer Overflows Disclosed Together
Key findings • Five vulnerabilities disclosed for NASA software including earthdata-search, cFS, and Trick between Aug 30-31, 2026. • High severity flaws include SSRF in earthdata-search and …
Key findings
- Five vulnerabilities disclosed for NASA software including earthdata-search, cFS, and Trick between Aug 30-31, 2026.
- High severity flaws include SSRF in earthdata-search and stack-based buffer overflow in Trick.
- cFS vulnerabilities include integer underflow and buffer overflow, impacting versions up to 7.0.1.
- Affected components range from data search endpoints to core system modules and network handlers.
- Users are urged to update to patched versions to mitigate risks of data breaches and system compromise.
On August 30th and 31st, 2026, a batch of five vulnerabilities was disclosed affecting NASA's software systems, including earthdata-search, cFS, and Trick. These vulnerabilities, ranging in severity from Medium to High, were reported across different components and could lead to critical security issues such as server-side request forgery and buffer overflows. The disclosures highlight potential weaknesses in how these systems handle user-provided data and network communications.
Two of the disclosed vulnerabilities, CVE-2026-82802 and CVE-2026-82801, affect the NASA earthdata-search 1.0.0 component. CVE-2026-82802, rated Medium, resides in the OpenSearchGranuleSearchLambda function within serverless/src/openSearchGranuleSearch/handler.js, and a manipulation of the openSearchOsdd argument can result in server-side request forgery (SSRF). Similarly, CVE-2026-82801, a High severity vulnerability, is found in the scaleImage function within serverless/src/scaleImage/handler.js, also leading to SSRF through manipulation of its arguments. These SSRF vulnerabilities in earthdata-search could allow attackers to trick the server into making requests to unintended locations.
Another set of vulnerabilities impacts NASA's cFS (Core Flight System) up to version 7.0.1. CVE-2026-82480, a High severity flaw, is located in the CFE_SB_GetUserDataLength function in src/cFS/cfe/modules/sb/fsw/src/cfe_sb_util.c. Manipulation of the TotalMsgSize/HdrSize argument can lead to an integer underflow. Additionally, CVE-2026-82479, a Medium severity vulnerability, affects the SBN TCP Module. Specifically, the OS_read function in modules/protocol/tcp/fsw/src/sbn_tcp_if.c is vulnerable to a buffer overflow when the MsgSz argument is manipulated, requiring an attack from within the local network.
The fifth vulnerability, CVE-2026-82478, impacts NASA's Trick software, version 19.6.0. This High severity issue is present in the JSONVariableServerThread::parse_request function within trick_source/sim_services/JSONVariableServer/JSONVariableServerThread.cpp. A manipulation of requests to the TCP Socket Handler can cause a stack-based buffer overflow, potentially allowing remote attackers to execute arbitrary code.
The timely disclosure of these vulnerabilities by security researchers underscores the importance of continuous security auditing for critical software used in space exploration and data management. Users of NASA's earthdata-search, cFS, and Trick software are advised to consult the relevant advisories and apply patches as they become available to mitigate the risks associated with these security flaws. The range of vulnerabilities, from SSRF to buffer overflows and integer underflows, highlights the diverse attack vectors that could be exploited if systems remain unpatched.
The vulnerabilities were disclosed between August 30th and August 31st, 2026. CVE-2026-82480, CVE-2026-82479, and CVE-2026-82478 were disclosed on August 30th, while CVE-2026-82802 and CVE-2026-82801 were disclosed on August 31st. The affected versions include earthdata-search 1.0.0, cFS up to 7.0.1, and Trick 19.6.0. Specific patches or updates for these issues should be sought from NASA's official software repositories and security advisories.
The potential impact of these vulnerabilities is significant, ranging from unauthorized data access and manipulation through SSRF to system compromise via buffer overflows and integer underflows. The remote exploitability of CVE-2026-82801 and CVE-2026-82478, in particular, warrants immediate attention from system administrators managing these NASA software components.
While the provided information does not detail specific threat actors or in-the-wild exploitation, the nature of these vulnerabilities suggests they could be attractive targets for state-sponsored actors or sophisticated cybercriminals seeking to compromise sensitive data or critical infrastructure.
Users are strongly recommended to update their systems to patched versions as soon as they are released by NASA. For cFS and Trick, it is crucial to apply updates to versions beyond 7.0.1 and 19.6.0, respectively. For earthdata-search, ensuring the deployment is updated to a version that addresses CVE-2026-82802 and CVE-2026-82801 is paramount.
This batch of vulnerabilities serves as a reminder of the ongoing need for robust security practices and timely patching within the aerospace and scientific computing communities. Continuous monitoring and proactive security measures are essential to protect the integrity and confidentiality of data and systems managed by organizations like NASA.