What is CVE-2026-1579?

CVE-2026-1579 is a critical-severity vulnerability in Px4 Autopilot, classified under Missing Authentication for Critical Function. CVSS score: 9.8/10. Published 2026-03-31.

How severe is CVE-2026-1579?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Auth bypass in Px4 Autopilot

CVE-2026-1579

The MAVLink communication protocol does not require cryptographic authentication by default. When MAVLink 2.0 message signing is not enabled, any message -- including SERIAL_CONTROL, which provides interactive shell access -- can be sent by an unauthenticated party with access to the MAVLink interface. PX4 provides MAVLink 2.0 message signing as the cryptographic authentication mechanism for all MAVLink communication. When signing is enabled, unsigned messages are rejected at the protocol level.

Vulnerability class: Broken Authentication

EPSS: 0.009 (56.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Px4 Autopilot — versions 1.16.0, v1.16.0 SITL

Weakness classification (CWE)

CWE-306 — Missing Authentication for Critical Function

References

ics-cert@hq.dhs.gov (Product)
ics-cert@hq.dhs.gov (Product)
ics-cert@hq.dhs.gov (US Government Resource, Third Party Advisory)
ics-cert@hq.dhs.gov (Third Party Advisory)

Frequently asked questions

What is CVE-2026-1579?: CVE-2026-1579 is a critical-severity vulnerability in Px4 Autopilot, classified under Missing Authentication for Critical Function. CVSS score: 9.8/10. Published 2026-03-31.
How severe is CVE-2026-1579?: Critical severity. CVSS v3 base score is 9.8 out of 10.