---
id: CVE-2026-1579
title: |-
  The MAVLink communication protocol does not require cryptographic 
  authentication by default
summary: |-
  The MAVLink communication protocol does not require cryptographic 
  authentication by default. When MAVLink 2.0 message signing is not 
  enabled, any message -- including SERIAL_CONTROL, which provides 
  interactive shell access -- can be s…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-306
vendor: px4
product: autopilot
affected:
  - autopilot = 1.16.0
published: '2026-03-31'
updated: '2026-07-29'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-1579'
references:
  - url: 'https://docs.px4.io/main/en/mavlink/message_signing'
    label: ics-cert@hq.dhs.gov
  - url: 'https://docs.px4.io/main/en/mavlink/security_hardening'
    label: ics-cert@hq.dhs.gov
  - url: >-
      https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-090-02.json
    label: ics-cert@hq.dhs.gov
  - url: 'https://www.cisa.gov/news-events/ics-advisories/icsa-26-090-02'
    label: ics-cert@hq.dhs.gov
tags:
  - nvd
epss: 0.00926
epssPercentile: 0.58998
ingestedAt: '2026-07-29T19:49:48.638Z'
---

## Overview

The MAVLink communication protocol does not require cryptographic 
authentication by default. When MAVLink 2.0 message signing is not 
enabled, any message -- including SERIAL_CONTROL, which provides 
interactive shell access -- can be sent by an unauthenticated party with
 access to the MAVLink interface. PX4 provides MAVLink 2.0 message 
signing as the cryptographic authentication mechanism for all MAVLink 
communication. When signing is enabled, unsigned messages are rejected 
at the protocol level.

## Affected

- `autopilot = 1.16.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.