CVE-2026-19918
SpaceX Starlink Router Gen 3 gRPC Management get_status access control
- State
- Published
- Severity
- 5.3 Medium
- Published
- Aug 15, 2026
- Updated
- Aug 18, 2026
- Reserved
- Aug 15, 2026
Description
A vulnerability has been found in SpaceX Starlink Router Gen 3 2025.11.14.mr64708.3. This affects the function get_status of the component gRPC Management Interface. The manipulation leads to improper access controls. The attack can only be initiated within the local network. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 6.3 Medium | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 6.3 Medium | CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 5.8 Medium | AV:A/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
Starlink Router Gen 3SpaceX |
|
References
- VDB-390168 | SpaceX Starlink Router Gen 3 gRPC Management get_status access controlvdb-entrytechnical-description
- VDB-390168 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- CVE-2026-19918 | CVE Analysis and Reportthird-party-advisory
- Submit #870897 | Spacex - Starlink Starlink Router Gen 3 2025.11.14.mr64708.3 Improper Access Controlsthird-party-advisory
- https://www.ararasat.com/blog/starlink-lan-grpc-control/exploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.