The MAVLink communication protocol does not require cryptographic authentication by default.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Mar 31, 2026 · NIST NVD

   Detected

   The MAVLink communication protocol does not require cryptographic authentication by default. When MAVLink 2.0 message signing is not enabled, any message -- including SERIAL_CONTROL, which provides interactive shell access -- can be sent by an unauthenticated party with access to the MAVLink interface. PX4 provides MAVLink 2.0 message signing as the cryptographic authentication mechanism for all M

2. Jul 29, 2026 · NIST NVD

   Updated

   The MAVLink communication protocol does not require cryptographic authentication by default. When MAVLink 2.0 message signing is not enabled, any message -- including SERIAL_CONTROL, which provides interactive shell access -- can be sent by an unauthenticated party with access to the MAVLink interface. PX4 provides MAVLink 2.0 message signing as the cryptographic authentication mechanism for all M

Affected

• cpe px4/autopilot1.16.0

Sources

• CVE.orgVulnerability recordCVE-2026-1579

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-1579

  The MAVLink communication protocol does not require cryptographic authentication by default. When MAVLink 2.0 message signing is not enabled, any message -- including SERIAL_CONTROL, which provides interactive shell access -- can be sent by an unauthenticated party with acces

  nvd.nist.gov

References

• Product · docs.px4.io
• Product · docs.px4.io
• Third Party Advisory · github.com
• Third Party Advisory · cisa.gov