Researchers disclose critical flaws in NASA’s AIT-GUI spacecraft console

Cycode has disclosed a chain of vulnerabilities in AIT-GUI, the operator console for NASA/JPL’s open-source AMMOS Instrument Toolkit, that could let an unauthenticated attacker issue arbitrary commands to the software’s spacecraft and instrument command bus. The chain, tracked as GHSA-p9r8-2q67-fp86 and rated 9.4 on the CVSS v3.1 scale, affects versions 2.5.1 and earlier, with 2.5.2 as the fixed release. The advisory, published August 13, 2026, notes that no CVE has been assigned.

The issues include missing authentication, CSRF protection, and a path traversal on the /seq route. Cycode said the server listens on 0.0.0.0:8080 by default and issues a session cookie without credentials, allowing a cross-origin POST to send commands. The fix in 2.5.2 binds to the configured host and adds a same-origin check, but Cycode says the missing authentication remains.

A separate CVE-2026-60112, rated 9.3 on CVSS v4, covers the same missing authentication flaw, but the two records disagree on the affected versions and fix. Cycode also noted that its /script/run traversal was verified against 2.5.0, not 2.5.1, and that the latest PyPI release is 2.4.1.