AIT-GUI weaknesses expose NASA ground-system command paths

Researchers at Cycode have disclosed a chain of security flaws in AIT-GUI, the browser-based operator console in NASA/JPL’s open-source AMMOS Instrument Toolkit. The advisory, GHSA-p9r8-2q67-fp86, carries a CVSS v3.1 score of 9.4 and says AIT-GUI 2.5.1 and earlier can allow an unauthenticated attacker to issue arbitrary spacecraft and instrument commands.

AIT-GUI is part of a framework used to build ground data systems that send commands to spacecraft and instruments and process returned telemetry. Cycode said version 2.5.2, released on August 12, 2026, addresses the reported exposure. No mission was named as using the affected software, and neither advisory reported exploitation.

Unauthenticated routes and browser-driven requests

The advisory says the web server read a configured host value but then bound to the hardcoded address 0.0.0.0 on port 8080 by default. It exposed state-changing routes without authentication, authorization or cross-site request forgery protection. The issues are classified as CWE-306, CWE-352 and CWE-22.

An attacker able to reach the port could send commands through POST /cmd, execute server-side scripts through POST /script/run, or run command sequences through POST /seq. The latter two endpoints were also cited for filesystem path handling based on unvalidated input, enabling access to files outside intended directories in the affected conditions.

Because the routes accept application/x-www-form-urlencoded bodies, browsers can treat requests as CORS “simple” requests. Cycode said that permits cross-origin POST requests without an OPTIONS preflight. As a result, a host-local or firewalled deployment could still be reached through an operator’s browser after the operator visits an attacker-controlled page.

What version 2.5.2 changes—and what remains disputed

The 2.5.2 release binds the configured host, defaulting to localhost, checks Origin or Referer against the server Host for POST, PUT, DELETE and PATCH requests, and confines /script/run and /seq to configured roots. Its changelog says non-browser clients that send neither header are unaffected by the same-origin check.

However, an examination of tagged source cited in the report found that version 2.5.2 still calls Sessions.create() and issues a session cookie without a credential check; the command route accepts requests carrying that cookie. A separate record, CVE-2026-60112, rated 9.3 under CVSS v4, describes the missing-authentication defect and places the fix at a different version boundary. The inconsistent advisory information follows a wider pattern of vulnerabilities affecting security tooling and exposed management interfaces, including insecure service attack chains, where attack chains and insecure services were also central concerns.

Package availability complicates patch validation

The report also found that PyPI listed AIT-GUI 2.4.1, uploaded in July 2023, as the latest published package. Versions 2.5.0, 2.5.1 and 2.5.2 did not appear in its release history, despite the Cycode advisory identifying pip as the package ecosystem. The 2.4.1 source reportedly retains the hardcoded 0.0.0.0 binding and unconfined path construction on both cited routes.

For organizations operating AIT-GUI or comparable ground-system consoles, the practical implication is to establish the exact deployed code source and version, limit network reachability, and require robust authentication and authorization for every command-capable endpoint. Binding to localhost and blocking browser cross-origin requests can reduce exposure, but they do not replace access control for systems that can issue operational commands.