CVE-2026-1579CWE-306

PX4 Autopilot Missing authentication for critical function

Critical · published March 31, 2026

CVSS v4.0
9.3
EPSS
1%
Percentile
60.1
In the wild
Unconfirmed
What it is

The MAVLink communication protocol does not require cryptographic

authentication by default. When MAVLink 2.0 message signing is not

enabled, any message -- including SERIAL_CONTROL, which provides

interactive shell access -- can be sent by an unauthenticated party with

access to the MAVLink interface. PX4 provides MAVLink 2.0 message

signing as the cryptographic authentication mechanism for all MAVLink

communication. When signing is enabled, unsigned messages are rejected

at the protocol level.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00926 · 60.1th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-03-31T20:20Z
EPSS history
Timeline
  • 31 MAR 20:20Z
    PX4 Autopilot Missing authentication for critical function
    cvelistv5