Ethical Hacking News
NASA's AMMOS Instrument Toolkit GUI has been found to have a critical vulnerability that exposes spacecraft to unauthenticated attackers. The flaw, discovered by Cycode, allows an attacker to issue arbitrary commands to the software's spacecraft and instrument command bus. The vulnerability was discovered in version 2.5.1 and earlier, and has been addressed in version 2.5.2. The vulnerability is rated 9.4 on the CVSS v3.1 scoring system and has been classified as a critical infrastructure vulnerability.
The AMMOS Instrument Toolkit GUI has security vulnerabilities that expose spacecraft to unauthenticated attackers. The vulnerabilities were rated 9.4 on the Common Vulnerability Scoring System (CVSS) v3.1 scoring system and impact AIT-GUI versions 2.5.1 and earlier. The vulnerabilities allow an unauthenticated attacker to issue arbitrary commands to the software's spacecraft and instrument command bus. A patch was released on August 12, 2026, but one of the vulnerabilities remains unaddressed. A second vulnerability, CVE-2026-60112, was published on July 29, 2026, and rated 9.3 on CVSS v4. The toolkit's core libraries carry an older unresolved entry, CVE-2024-35058, a critical remote code execution flaw.
The security vulnerabilities in NASA's AMMOS Instrument Toolkit GUI (Graphical User Interface) have been found to expose spacecraft to unauthenticated attackers. The flaws were discovered by security researchers at Cycode, who identified a chain of vulnerabilities in the AIT-GUI that allow an unauthenticated attacker to issue arbitrary commands to the software's spacecraft and instrument command bus.
The vulnerabilities were rated 9.4 on the Common Vulnerability Scoring System (CVSS) v3.1 scoring system and impact AIT-GUI versions 2.5.1 and earlier. The advisory, published August 13, 2026, states that no CVE has been assigned to it.
The AMMOS Instrument Toolkit is a framework for building ground data systems, the software that sends commands to instruments and spacecraft and processes the telemetry coming back down. AIT-GUI is its operator console, and the endpoints in question relay operator commands to a command bus.
Cycode said in the advisory that "The blast radius of an unauthenticated POST is measured in issued instrument commands, not defaced pages." Two of those routes also build filesystem paths from unvalidated input. The issues are classified as CWE-306, CWE-352, and CWE-22.
The advisory states that an unauthenticated party who can reach the port can do the following: Issue arbitrary instrument and spacecraft commands via POST /cmd, Execute server-side scripts via POST /script/run, including files outside the intended directory via path traversal, and Run command sequences via POST /seq, including out-of-directory files passed to a subprocess.
Yuval Elbar, a security researcher at Cycode, said, "A web GUI used to drive spacecraft and instrument commanding shipped a server that listens on every network interface, asks nobody for a password, and can be steered by any web page an operator happens to open."
Because the routes accept application/x-www-form-urlencoded bodies, which browsers treat as CORS "simple" requests, the advisory said a cross-origin POST reaches them without a preflight, so a host-local or firewalled deployment remains exploitable if an operator with browser access to the console visits a page an attacker controls.
Cycode 2.5.2 was released on August 12, 2026, It binds the configured host, defaulting to localhost, adds a before_request hook that compares a request's Origin or Referer against the server's own Host for POST, PUT, DELETE, and PATCH, and confines scriptPath on /script/run using the canonicalization and containment check. However, one element of the Cycode advisory's scope does not hold for the release it names. The advisory states its findings were verified in release 2.5.1 and on master, but the tagged 2.5.1 source already confines scriptPath on /seq using the canonicalization and containment check. The unconfined path construction in 2.5.1 is on /seq.
In addition to the vulnerability in the AMMOS Instrument Toolkit GUI, a second record covers the same missing-authentication defect in the same file. CVE-2026-60112, rated 9.3 on CVSS v4 and credited to Saidakbarxon Maxsudxonov, was published to the National Vulnerability Database and the GitHub Advisory Database on July 29, 2026, three weeks before the Cycode writeup.
The toolkit's core libraries carry an older unresolved entry, CVE-2024-35058, a critical remote code execution flaw in the API wait function of NASA AIT-Core, was published in May 2024, affects versions up to and including 2.5.2, and its GitHub Advisory Database record still lists its patched versions as none.
Related Information:
https://www.ethicalhackingnews.com/articles/NASAs-AMMOS-Instrument-Toolkit-GUI-Flaw-Exposes-Spacecraft-to-Unauthenticated-Attackers-ehn.shtml
https://thehackernews.com/2026/08/nasa-ait-gui-flaws-could-let.html
Published: Thu Aug 20 07:34:13 2026 by llama3.2 3B Q4_K_M
