NASA AIT-GUI Flaws Could Let Unauthenticated Attackers Issue Spacecraft Commands

Security researchers at Cycode have disclosed a chain of flaws in AIT-GUI, the browser-based operator console for NASA/JPL's open-source AMMOS Instrument Toolkit, that allow an unauthenticated attacker to issue arbitrary commands to the software's spacecraft and instrument command bus. The chain,...

CVE-2026-60112 AIT-GUI < 2.5.1 Missing Authentication via Sessions.create()

AMMOS Instrument Toolkit AIT GUI before 2.5.1 contains a missing authentication vulnerability that allows any unauthenticated network attacker to obtain a valid session and issue arbitrary spacecraft commands by calling Sessions.create without any credential check. Attackers can exploit the...

CVE-2026-60112

AMMOS Instrument Toolkit (AIT) GUI before 2.5.1 has a missing authentication flaw in Sessions.create(), enabling an unauthenticated network attacker to obtain a valid session and issue arbitrary spacecraft commands. After session issuance, handle_cmd() can forward commands to the AIT command bus ...

CVE-2026-60112: Missing Authentication for Critical Function

AMMOS Instrument Toolkit AIT GUI before 2.5.1 contains a missing authentication vulnerability that allows any unauthenticated network attacker to obtain a valid session and issue arbitrary spacecraft commands by calling Sessions.create without any credential check. Attackers can exploit the...

ait-core (>=2.4.0, <=2.5.2), ait-gui (>=2.4.0, <=2.4.1) +1 more potentially affected by CVE-2023-41419 via gevent (22.10.1)

gevent PYPI version 22.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on gevent and may be impacted: - ait-core =2.4.0, =2.4.0, =2.4.1 - modoboa 2.0.3 Source cves: CVE-2023-41419 Source advisory: OSV:GHSA-X7M3-JPRG-WC5G...