NASA AIT-GUI Flaws Could Let Unauthenticated Attackers Issue Spacecraft Commands
Researchers disclosed 9.4-CVSS flaws in NASA/JPL's AIT-GUI allowing unauthenticated attackers to issue arbitrary spacecraft commands via exposed command endpoints.
Cycode disclosed a flaw chain in AIT-GUI, the browser-based operator console for NASA/JPL's open-source AMMOS Instrument Toolkit, tracked as GHSA-p9r8-2q67-fp86 with CVSS 9.4, affecting versions 2.5.1 and earlier. The server binds to 0.0.0.0:8080, issues sessions without credential checks, and lets unauthenticated users issue spacecraft commands via POST /cmd and reach files outside intended directories via /script/run and /seq (CWE-306, CWE-352, CWE-22). Version 2.5.2 adds host binding and same-origin checks but does not add authentication, and a related missing-authentication flaw was published separately as CVE-2026-60112 with CVSS 9.3.
- Flaws affect AIT-GUI 2.5.1 and earlier; the Cycode advisory lists 2.5.2 as the fixed release
- A session is obtainable without credentials via GET /, then POST /cmd sends arbitrary commands
- Cross-origin POSTs work without preflight because endpoints accept form-urlencoded bodies
- No CVE was assigned to the Cycode advisory; CVE-2026-60112 rates the missing-auth flaw 9.3
- Records disagree on the fix: VulnCheck and NVD point to commit beb8fc0 in versions before 2.5.1
- CVEs
- CVE-2026-60112
- Products
- AMMOS Instrument ToolkitAIT-GUI
- Organizations
- The Hacker News
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-60112 | AMMOS Instrument Toolkit (AIT) GUI before 2.5.1 contains a missing authentication vulnerability that allows any unauthenticated network attacker to obtain a… | 9.3 | <1% |
From the original article
6 min read at thehackernews.com
Security researchers at Cycode have disclosed a chain of flaws in AIT-GUI, the browser-based operator console for NASA/JPL's open-source AMMOS Instrument Toolkit, that allow an unauthenticated attacker to issue arbitrary commands to the software's spacecraft and instrument command bus. The chain, tracked as GHSA-p9r8-2q67-fp86 and rated 9. 4 on the CVSS v3.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.