Security researchers at Cycode have disclosed a chain of flaws in AIT-GUI, the browser-based operator console for NASA/JPL’s open-source AMMOS Instrument Toolkit, that allow an unauthenticated attacker to issue arbitrary commands to the software’s spacecraft and instrument command bus.
The chain, tracked as GHSA-p9r8-2q67-fp86 and rated 9.4 on the CVSS v3.1 scoring system, impacts AIT-GUI versions 2.5.1 and earlier and has been addressed in version 2.5.2. The advisory, published August 13, 2026, states that no CVE has been assigned to it.
The AMMOS Instrument Toolkit is a framework for building ground data systems, the software that sends commands to instruments and spacecraft and processes the telemetry coming back down. AIT-GUI is its operator console, and the endpoints in question relay operator commands to a command bus.
“The blast radius of an unauthenticated POST is measured in issued instrument commands, not defaced pages,” Cycode said in the writeup.
According to the advisory, the AIT-GUI web server reads its configured host value and then discards it, binding the listener to the hardcoded address 0.0.0.0 on port 8080 by default, and exposes every state-changing route with no authentication, no authorization, and no cross-site request forgery (CSRF) protection.
Two of those routes also build filesystem paths from unvalidated input. The issues are classified as CWE-306, CWE-352, and CWE-22.
The advisory said an unauthenticated party who can reach the port can do the following –
- Issue arbitrary instrument and spacecraft commands via POST /cmd
- Execute server-side scripts via POST /script/run, including files outside the intended directory via path traversal
- Run command sequences via POST /seq, including out-of-directory files passed to a subprocess
“A web GUI used to drive spacecraft and instrument commanding shipped a server that listens on every network interface, asks nobody for a password, and can be steered by any web page an operator happens to open,” Yuval Elbar, a security researcher at Cycode, said.
Because the routes accept application/x-www-form-urlencoded bodies, which browsers treat as CORS “simple” requests, the advisory said a cross-origin POST reaches them without a preflight, so a host-local or firewalled deployment remains exploitable if an operator with browser access to the console visits a page an attacker controls.
“Captured network traffic from a real browser confirms the cross-origin POST is delivered with zero OPTIONS preflight requests, and the server processes it,” the advisory said.
AIT-GUI 2.5.2 was released on August 12, 2026. It binds the configured host, defaulting to localhost, adds a before_request hook that compares a request’s Origin or Referer against the server’s own Host for POST, PUT, DELETE, and PATCH, and confines /script/run and /seq to their configured roots.
“State-changing endpoints (POST/PUT/DELETE/PATCH) now reject cross-origin browser requests via a same-origin (Origin/Referer vs Host) check, mitigating CSRF. Non-browser clients that send neither header are unaffected,” the project said in the changelog for version 2.5.2.
After reviewing the advisory, The Hacker News examined the tagged source for versions 2.4.1, 2.5.1, and 2.5.2 in the project’s repository. In 2.5.2, the root route still calls Sessions.create() and issues a session cookie to any request without a credential check, and the command route accepts any request carrying that cookie.
THN confirmed against the tagged 2.5.2 source on August 20, 2026, that the release restricts where the console listens and blocks browser-driven cross-origin requests, and does not add authentication to the command, script, or sequence endpoints.
We also confirmed via PyPI on August 20, 2026, that the latest published release of the ait-gui package is 2.4.1, uploaded on July 27, 2023, and that versions 2.5.0, 2.5.1, and 2.5.2 do not appear in the release history. The 2.4.1 source carries the same hardcoded 0.0.0.0 bind and the same unconfined path construction on both routes, and PyPI lists no vulnerabilities for it. The advisory identifies the affected package ecosystem as pip.
Separately, a second record covers the same missing-authentication defect in the same file. CVE-2026-60112, rated 9.3 on CVSS v4 and credited to Saidakbarxon Maxsudxonov, was published to the National Vulnerability Database and the GitHub Advisory Database on July 29, 2026, three weeks before the Cycode writeup.
“AMMOS Instrument Toolkit (AIT) GUI before 2.5.1 contains a missing authentication vulnerability that allows any unauthenticated network attacker to obtain a valid session and issue arbitrary spacecraft commands by calling Sessions.create() without any credential check,” VulnCheck said in an advisory carrying the CVE description.
The two records disagree on the fix. VulnCheck and the NVD entry place the flaw in versions before 2.5.1 and cite commit beb8fc0 as the patch, but the Cycode advisory lists 2.5.1 as affected and 2.5.2 as the fixed release. The repository shows the unauthenticated session issuance present in both 2.5.1 and 2.5.2.
One element of the Cycode advisory’s scope does not hold for the release it names. The advisory states its findings were verified in release 2.5.1 and on master, and The Hacker News found that the tagged 2.5.1 source already confines scriptPath on /script/run using the canonicalization and containment check the advisory recommends. The unconfined path construction in 2.5.1 is on /seq.
GHSA-p9r8-2q67-fp86 does not appear in GitHub’s global advisory database, and CVE-2026-60112 is listed there as unreviewed with no package, no affected version range, and no Dependabot support. Neither record is reflected in PyPI’s vulnerability data for the package.
Elbar authored the commit carrying the fix on July 10, 2026, and includes a Co-Authored-By trailer naming Anthropic’s Claude Opus 4.8 model. It adds 18 regression tests, and its message states that they fail on the pre-fix code and pass after it.
“This bug was found the way we think most real research will be done from here on: a human researcher working alongside AI-assisted code analysis,” Cycode said in the writeup.
Neither record names a mission running the software, nor does either report exploitation. The GitHub Advisory Database carries several other unreviewed records for NASA ground software, including CVE-2026-47731, described as a path traversal in the AMMOS Instrument Toolkit resulting in arbitrary file append that can be triggered over the network, and critical records for the NASA-AMMOS Aerie/PlanDev sequencing server (CVE-2026-71214) and the Asynchronous Network Management System reference implementation (CVE-2026-71289).
The toolkit’s core libraries carry an older unresolved entry. CVE-2024-35058, a critical remote code execution flaw in the API wait function of NASA AIT-Core, was published in May 2024, affects versions up to and including 2.5.2, and its GitHub Advisory Database record still lists its patched versions as none.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.