CVE-2026-1579
The MAVLink protocol used by PX4 autopilot does not enforce cryptographic authentication unless message signing is enabled. If signing is disabled, anyone with access to the MAVLink interface can send any message, including those that grant shell access. Enabling MAVLink 2.0 message signing blocks unsigned messages at the protocol level.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
PX4 autopilot version 1.16.0
Real-world impact
An attacker who can reach the MAVLink interface could send malicious commands, including opening an interactive shell, and potentially take full control of the vehicle or its systems.
Why this severity
The CVSS score of 9.3 reflects that the flaw allows remote attackers to execute arbitrary commands with high privileges, requires no user interaction, and has no authentication or authorization checks.
What to do about it
- 01Enable MAVLink 2.0 message signing in the PX4 configuration.
- 02Restart the PX4 autopilot to apply the change.
NVD-referenced vendor advisory
Timeline
- Mar 31, 2026 · Mar 31, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 26, 2026 · 10d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
- Jul 29, 2026 · 7d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- docs.px4.io/main/en/mavlink/message_sig…product
- docs.px4.io/main/en/mavlink/security_ha…product
- github.com/cisagov/CSAF/blob/develop/c…third party advisory
- cisa.gov/news-events/ics-advisories/…third party advisoryus government resource