Holes in NASA's AIT-GUI let attackers send commands to spacecraft without a password

Researchers at Cycode have made public a chain of vulnerabilities in AIT-GUI — the browser-based operator console for the open-source AMMOS Instrument Toolkit developed by NASA and the Jet Propulsion Laboratory (JPL). AMMOS is a framework for building ground systems that send commands to instruments and spacecraft and process the telemetry coming back. AIT-GUI serves as the operator's console, and its endpoints relay commands to the command bus.

The problem (identifier GHSA-p9r8-2q67-fp86, rated 9.4 on CVSS v3.1) affects versions 2.5.1 and below and was fixed in 2.5.2. As Cycode puts it, “the blast radius of an unauthenticated POST request is measured not in defaced pages, but in commands sent to instruments.”

What's wrong

The AIT-GUI web server reads the address specified in the configuration — and then immediately discards it, binding instead to a hardcoded 0.0.0.0 on port 8080. All state-changing routes are open with no authentication, authorization, or CSRF protection. Two endpoints additionally build filesystem paths from unvalidated input (classifications CWE-306, CWE-352, and CWE-22).

Anyone who can reach the port is able to send arbitrary commands via POST /cmd, run server-side scripts via /script/run (including outside the directory, through path traversal), and execute command sequences via /seq. Because the requests are accepted in x-www-form-urlencoded format, the browser treats them as “simple” and does not send a preflight OPTIONS request — which means that even an installation isolated behind a firewall is vulnerable if an operator with console access opens a page prepared by the attacker.

The fix and the disagreements

Version 2.5.2 (released on August 12, 2026) binds to the configured address, defaulting to localhost, adds a check of the Origin/Referer headers against Host for state-changing methods, and restricts /script/run and /seq to their directories. However, as The Hacker News found, authentication was still never added to the command routes: the root route continues to hand a session cookie to any request, and a command is accepted on the strength of that cookie.

The story is muddied by a second entry — CVE-2026-60112 (9.3 on CVSS v4), published three weeks before the Cycode report. The two entries disagree on which version counts as fixed, and on PyPI the latest published version of the package remains 2.4.1 from as far back as July 2023 — with the same hardcoded 0.0.0.0 and unprotected paths. No exploitation in the wild has been recorded, and the specific mission using the software has not been named.

A curious detail: the commit with the fix was prepared by Cycode researcher Yuval Elbar, and its Co-Authored-By trailer lists Anthropic's Claude Opus 4.8 model. “This bug was found the way we believe real research will be done from now on: a human working side by side with AI code analysis,” Cycode noted.

Source: The Hacker News