Significant security vulnerabilities have been discovered in the AIT-GUI, a key component of NASA’s open-source AMMOS Instrument Toolkit, threatening the security of spacecraft command systems. Disclosed by Cycode, these flaws allow unauthorized users to send arbitrary commands, posing a critical risk to NASA’s operations.
Details of the Vulnerability
The vulnerabilities, cataloged as GHSA-p9r8-2q67-fp86, received a high severity score of 9.4 on the CVSS v3.1 scale. They impact AIT-GUI versions up to 2.5.1, with fixes implemented in version 2.5.2. Despite the severity, no CVE was assigned. These flaws enable unauthorized command execution due to the software’s inadequate authentication mechanisms.
Researchers highlighted that the AIT-GUI web server, by default, binds to all network interfaces, exposing critical routes without authentication or CSRF protection. This configuration allows for command issuing, script execution, and command sequence running through unprotected routes, increasing the risk of unauthorized access.
Security Measures and Fixes
Version 2.5.2, released on August 12, 2026, addresses these vulnerabilities by restricting network binding to localhost and implementing origin checks for state-changing requests. This update mitigates cross-origin request attacks, although non-browser clients remain unaffected.
However, the updated version still issues session cookies without credential verification, leaving some vulnerabilities unaddressed. The release history on PyPI shows discrepancies, with the latest available package being 2.4.1, complicating the tracking of fixes and vulnerabilities.
Ongoing Concerns and Future Outlook
Despite the release of version 2.5.2, concerns remain regarding complete resolution. A parallel vulnerability, CVE-2026-60112, further highlights authentication gaps in previous versions. Different sources provide conflicting information on the affected versions and fixes, underscoring the need for thorough verification and continuous monitoring.
This incident emphasizes the importance of robust security measures in mission-critical systems like those used by NASA. As technology evolves, collaborative efforts between human researchers and AI tools, as seen in the Cycode study, will likely play a crucial role in identifying and resolving such vulnerabilities.
Looking ahead, NASA and its partners must prioritize comprehensive security audits and updates to safeguard against potential exploitation, ensuring the integrity of space missions and the safety of spacecraft operations.
