Critical flaw in NASA/JPL spacecraft command software allows unauthenticated command execution

Research · 22 August 2026 · Source: Security Affairs

Critical Flaw in NASA/JPL Open-Source Spacecraft Command Software Allowed Unauthenticated Command Execution — Image: Security Affairs

Cycode researchers have disclosed a critical vulnerability in AIT-GUI, the web-based operator console of NASA/JPL’s open-source AMMOS Instrument Toolkit. The flaw, tracked as GHSA-p9r8-2q67-fp86 and rated 9.4 on the CVSS scale, allows unauthenticated command execution on spacecraft instruments.

The software shipped with no authentication, no session checks, and no CSRF protection on any state-changing endpoints, and it binds to all network interfaces regardless of the configured host. An attacker who can reach the port, or trick an operator into visiting a malicious website, can send commands, modify sequences, or run scripts.

The issue is fixed in AIT-GUI 2.5.2, and operators are urged to upgrade immediately and audit command history if they ran an exposed instance.

Market intelligence, weekly