Security researchers at Cycode have disclosed a chain of flaws in AIT-GUI, the browser-based operator console for NASA/JPL's open-source AMMOS Instrument Toolkit, that allow an unauthenticated attacker to issue arbitrary commands to the software's spacecraft and instrument command bus.
The chain, tracked as GHSA-p9r8-2q67-fp86 and rated 9.4 on the CVSS v3.1 scoring system, impacts AIT-GUI versions 2.5.1 and earlier, with the advisory listing version 2.5.2 as the fixed release. The advisory, published August 13, 2026, states that no CVE has been assigned to it.
The AMMOS Instrument Toolkit is a framework for building ground data systems, the software that sends commands to instruments and spacecraft and processes the telemetry coming back down. AIT-GUI is its operator console, and the endpoints in question relay operator commands to a command bus.
"The blast radius of an unauthenticated POST is measured in issued instrument commands, not defaced pages," Cycode said in the writeup.
According to the advisory, the AIT-GUI web server reads its configured host value and then discards it, binding the listener to the hardcoded address 0.0.0.0 on port 8080 by default, and exposes the command, script, and sequence routes without credential-based authentication or authorization and without cross-site request forgery (CSRF) protection. Cycode clarified that the routes are gated by a session cookie, but a session can be obtained without credentials by requesting the root page.
Two of those routes also build filesystem paths from unvalidated input. The issues are classified as CWE-306, CWE-352, and CWE-22.
The advisory said an unauthenticated party who can reach the port can do the following -
- Issue arbitrary instrument and spacecraft commands via POST /cmd
- Execute server-side scripts via POST /script/run, including files outside the intended directory via path traversal
- Run command sequences via POST /seq, including out-of-directory files passed to a subprocess
Cycode clarified that a command cannot be sent with a single anonymous request. A request to POST /cmd without a valid session cookie returns HTTP 401, but GET / calls Sessions.create() and returns a sid cookie without requiring credentials. Repeating the command request with that cookie passes the session check and sends the command.
"A web GUI used to drive spacecraft and instrument commanding shipped a server that listens on every network interface, asks nobody for a password, and can be steered by any web page an operator happens to open," Yuval Elbar, a security researcher at Cycode, said.
Cycode said its proof-of-concept for the cross-origin portion of the chain was run on localhost. Because the routes accept application/x-www-form-urlencoded bodies, which browsers treat as CORS "simple" requests, the test showed that a cross-origin POST can be delivered without a preflight and processed by the server. Cycode said the same conditions can hold against a network-reachable instance, but the remote path was not independently exploited as part of its work.
"Captured network traffic from a real browser confirms the cross-origin POST is delivered with zero OPTIONS preflight requests, and the server processes it," the advisory said.
AIT-GUI 2.5.2 was released on August 12, 2026. It binds the configured host, defaulting to localhost, adds a before_request hook that compares a request's Origin or Referer against the server's own Host for POST, PUT, DELETE, and PATCH, and confines /script/run and /seq to their configured roots.
"State-changing endpoints (POST/PUT/DELETE/PATCH) now reject cross-origin browser requests via a same-origin (Origin/Referer vs Host) check, mitigating CSRF. Non-browser clients that send neither header are unaffected," the project said in the changelog for version 2.5.2.
After reviewing the advisory, The Hacker News examined the tagged source for versions 2.4.1, 2.5.1, and 2.5.2 in the project's repository. In 2.5.2, the root route still calls Sessions.create() and issues a session cookie to any request without a credential check, and the command route accepts any request carrying that cookie.
THN confirmed against the tagged 2.5.2 source on August 20, 2026, that the release restricts where the console listens and blocks browser-driven cross-origin requests, and does not add authentication to the command, script, or sequence endpoints. Cycode told The Hacker News that it therefore does not consider the chain fully remediated in 2.5.2, saying the release addresses the remote exposure and cross-site delivery paths but leaves the missing-authentication weakness intact.
We also confirmed via PyPI on August 20, 2026, that the latest published release of the ait-gui package is 2.4.1, uploaded on July 27, 2023, and that versions 2.5.0, 2.5.1, and 2.5.2 do not appear in the release history. The 2.4.1 source carries the same hardcoded 0.0.0.0 bind and the same unconfined path construction on both routes, and PyPI lists no vulnerabilities for it. The advisory identifies the affected package ecosystem as pip.
Separately, a second record covers the same missing-authentication defect in the same file. CVE-2026-60112, rated 9.3 on CVSS v4 and credited to Saidakbarxon Maxsudxonov, was published to the National Vulnerability Database and the GitHub Advisory Database on July 29, 2026, three weeks before the Cycode writeup.
"AMMOS Instrument Toolkit (AIT) GUI before 2.5.1 contains a missing authentication vulnerability that allows any unauthenticated network attacker to obtain a valid session and issue arbitrary spacecraft commands by calling Sessions.create() without any credential check," VulnCheck said in an advisory carrying the CVE description.
The two records disagree on the fix. VulnCheck and the NVD entry place the flaw in versions before 2.5.1 and cite commit beb8fc0 as the patch, but the Cycode advisory lists 2.5.1 as affected and 2.5.2 as the fixed release. The repository shows the unauthenticated session issuance present in both 2.5.1 and 2.5.2.
Cycode told The Hacker News that it was aware of CVE-2026-60112 before publishing its writeup on August 18 and considers its advisory a distinct finding, while acknowledging that the two share the same root missing-authentication weakness. It characterized CVE-2026-60112 as covering the credential-free session issuance and arbitrary command primitive, while its advisory reports a broader chain combining that weakness with cross-origin/CSRF delivery and the path traversal issue on /seq.
One element of the Cycode advisory's scope does not hold for the release it names. Cycode told The Hacker News that the /script/run traversal was verified against the 2.5.0 release branch, not 2.5.1, making the advisory's statement about 2.5.1 verification inaccurate. The tagged 2.5.1 source already confines scriptPath on /script/run using the canonicalization and containment check the advisory recommends, while the unconfined path construction in 2.5.1 remains on /seq.
GHSA-p9r8-2q67-fp86 does not appear in GitHub's global advisory database, and CVE-2026-60112 is listed there as unreviewed with no package, no affected version range, and no Dependabot support. Neither record is reflected in PyPI's vulnerability data for the package.
Elbar authored the commit carrying the fix on July 10, 2026, and includes a Co-Authored-By trailer naming Anthropic's Claude Opus 4.8 model. It adds 18 regression tests, and its message states that they fail on the pre-fix code and pass after it.
"This bug was found the way we think most real research will be done from here on: a human researcher working alongside AI-assisted code analysis," Cycode said in the writeup.
Neither record names a mission running the software, nor does either report exploitation. The GitHub Advisory Database carries several other unreviewed records for NASA ground software, including CVE-2026-47731, described as a path traversal in the AMMOS Instrument Toolkit resulting in arbitrary file append that can be triggered over the network, and critical records for the NASA-AMMOS Aerie/PlanDev sequencing server (CVE-2026-71214) and the Asynchronous Network Management System reference implementation (CVE-2026-71289).
The toolkit's core libraries carry an older unresolved entry. CVE-2024-35058, a critical remote code execution flaw in the API wait function of NASA AIT-Core, was published in May 2024, affects versions up to and including 2.5.2, and its GitHub Advisory Database record still lists its patched versions as none.
Corrected: An earlier version overstated the verified scope of the cross-origin chain and said the /script/run traversal was verified in AIT-GUI 2.5.1 and that the chain was addressed in 2.5.2. Cycode clarified that the browser PoC was run on localhost, /script/run was tested against 2.5.0 and fixed in 2.5.1, and 2.5.2 still does not add credential-based authentication to the affected routes.