NASA AIT-GUI Flaws Could Let Unauthenticated Attackers Issue Spacecraft Commands

Security researchers at Cycode have disclosed a chain of flaws in AIT-GUI, the browser-based operator console for NASA/JPL's open-source AMMOS Instrument Toolkit, that allow an unauthenticated attacker to issue arbitrary commands to the software's spacecraft and instrument command bus. The chain,...

Missing Authentication for Critical Function

Overview ait-gui is an A framework for building a custom website for realtime telemetry monitoring, commanding, and other MOS operations, built atop the AIT Core libraries. Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the Sessions.create...

CVE-2026-60112

AMMOS Instrument Toolkit (AIT) GUI before 2.5.1 has a missing authentication flaw in Sessions.create(), enabling an unauthenticated network attacker to obtain a valid session and issue arbitrary spacecraft commands. After session issuance, handle_cmd() can forward commands to the AIT command bus ...

CVE-2026-60112

AMMOS Instrument Toolkit AIT GUI before 2.5.1 contains a missing authentication vulnerability that allows any unauthenticated network attacker to obtain a valid session and issue arbitrary spacecraft commands by calling Sessions.create without any credential check. Attackers can exploit the...

CVE-2026-60112 AIT-GUI < 2.5.1 Missing Authentication via Sessions.create()

AMMOS Instrument Toolkit AIT GUI before 2.5.1 contains a missing authentication vulnerability that allows any unauthenticated network attacker to obtain a valid session and issue arbitrary spacecraft commands by calling Sessions.create without any credential check. Attackers can exploit the...

CVE-2026-60112: Missing Authentication for Critical Function

AMMOS Instrument Toolkit AIT GUI before 2.5.1 contains a missing authentication vulnerability that allows any unauthenticated network attacker to obtain a valid session and issue arbitrary spacecraft commands by calling Sessions.create without any credential check. Attackers can exploit the...

ait-dsn (2.0.0), ait-gui (>=2.4.0, <=2.4.1) potentially affected by CVE-2026-47731 via ait-core (>=2.3.5, <=2.5.2)

ait-core PYPI version =2.3.5, =2.4.0, =2.4.1 Source cves: CVE-2026-47731 Source advisory: MEND:CVE-2026-47731...

ait-dsn (2.0.0), ait-gui (>=2.4.0, <=2.4.1) potentially affected by CVE-2024-35061 via ait-core (>=2.3.5, <=2.5.2)

ait-core PYPI version =2.3.5, =2.4.0, =2.4.1 Source cves: CVE-2024-35061 Source advisory: OSV:PYSEC-2026-1113...

ait-dsn (2.0.0), ait-gui (>=2.4.0, <=2.4.1) potentially affected by CVE-2026-47731 via ait-core (>=2.3.5, <=2.5.2)

ait-core PYPI version =2.3.5, =2.4.0, =2.4.1 Source cves: CVE-2026-47731 Source advisory: OSV:PYSEC-2026-265...

ait-dsn (2.0.0), ait-gui (>=2.4.0, <=2.4.1) potentially affected by CVE-2024-35058 via ait-core (>=2.3.5, <=2.5.2)

ait-core PYPI version =2.3.5, =2.4.0, =2.4.1 Source cves: CVE-2024-35058 Source advisory: OSV:PYSEC-2026-261...

ait-dsn (2.0.0), ait-gui (>=2.4.0, <=2.4.1) potentially affected by CVE-2024-35056 via ait-core (>=2.3.5, <=2.5.2)

ait-core PYPI version =2.3.5, =2.4.0, =2.4.1 Source cves: CVE-2024-35056 Source advisory: OSV:PYSEC-2026-262...

ait-dsn (2.0.0), ait-gui (>=2.4.0, <=2.4.1) potentially affected by CVE-2024-35057 via ait-core (>=2.3.5, <=2.5.2)

ait-core PYPI version =2.3.5, =2.4.0, =2.4.1 Source cves: CVE-2024-35057 Source advisory: OSV:PYSEC-2026-263...

ait-dsn (2.0.0), ait-gui (>=2.4.0, <=2.4.1) potentially affected by CVE-2024-35059 via ait-core (>=2.3.5, <=2.5.2)

ait-core PYPI version =2.3.5, =2.4.0, =2.4.1 Source cves: CVE-2024-35059 Source advisory: OSV:PYSEC-2026-264...

ait-dsn (2.0.0), ait-gui (>=2.4.0, <=2.4.1) potentially affected by CVE-2026-47731 via ait-core (>=2.3.5, <=2.5.2)

ait-core PYPI version =2.3.5, =2.4.0, =2.4.1 Source cves: CVE-2026-47731 Source advisory: GHSA-P462-PRXW-MJX4...

ait-dsn (2.0.0), ait-gui (>=2.4.0, <=2.4.1) potentially affected by CVE-2026-47731 via ait-core (>=2.3.5, <=2.5.2)

ait-core PYPI version =2.3.5, =2.4.0, =2.4.1 Source cves: CVE-2026-47731 Source advisory: OSV:GHSA-P462-PRXW-MJX4...

ait-dsn (2.0.0), ait-gui (>=2.4.0, <=2.4.1) potentially affected by CVE-2026-47731 via ait-core (>=2.3.5, <=2.5.2)

ait-core PYPI version =2.3.5, =2.4.0, =2.4.1 Source cves: CVE-2026-47731 Source advisory: SNYK:PYTHON-AITCORE-17670580...

ait-dsn (2.0.0), ait-gui (>=2.4.0, <=2.4.1) potentially affected by CVE-2024-35059 via ait-core (>=2.3.5, <=2.5.2)

ait-core PYPI version =2.3.5, =2.4.0, =2.4.1 Source cves: CVE-2024-35059 Source advisory: GHSA-JQFF-8G2V-642H...

ait-dsn (2.0.0), ait-gui (>=2.4.0, <=2.4.1) potentially affected by CVE-2024-35061 via ait-core (>=2.3.5, <=2.5.2)

ait-core PYPI version =2.3.5, =2.4.0, =2.4.1 Source cves: CVE-2024-35061 Source advisory: GHSA-QV6X-53JJ-VW59...

ait-dsn (2.0.0), ait-gui (>=2.4.0, <=2.4.1) potentially affected by CVE-2024-35059 +1 more via ait-core (>=2.3.5, <=2.5.2)

ait-core PYPI version =2.3.5, =2.4.0, =2.4.1 Source cves: CVE-2024-35059, CVE-2024-35061 Source advisory: OSV:GHSA-JQFF-8G2V-642H...

ait-dsn (2.0.0), ait-gui (>=2.4.0, <=2.4.1) potentially affected by CVE-2024-35061 via ait-core (>=2.3.5, <=2.5.2)

ait-core PYPI version =2.3.5, =2.4.0, =2.4.1 Source cves: CVE-2024-35061 Source advisory: OSV:GHSA-QV6X-53JJ-VW59...