NASA JPL AIT-GUI Missing Authentication and CSRF Flaw Allows Unauthenticated Spacecraft Command Injection (CVE-2026-60112, CVSS 9.8/9.4) — Threadlinqs Intelligence
As of 2026-08-23, NASA JPL AIT-GUI Missing Authentication and CSRF Flaw Allows Unauthenticated Spacecraft Command Injection (CVE-2026-60112, CVSS 9.8/9.4) is a critical-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 14 indicators of compromise.
Threat ID: TL-2026-2081 · Severity: CRITICAL · CVSS: 9.4 · Status: PATCHED · Category: VULNERABILITY
Updated: 2026-08-23 · revalidated 1× · latest source
A critical vulnerability (GHSA-p9r8-2q67-fp86, CVSS 9.4) in NASA/JPL's open-source AMMOS Instrument Toolkit GUI (AIT-GUI) — a browser-based spacecraft operator console — combines missing
The AMMOS Instrument Toolkit GUI (AIT-GUI) is an open-source browser-based operator console developed by NASA's Jet Propulsion Laboratory (JPL) as part of the Advanced Multi-Mission Operations System (AMMOS) Instrument Toolkit (AIT). It serves as the primary human interface for commanding spacecraft and scientific instruments, translating operator button clicks into commands relayed to the AIT command bus and ultimately to flight hardware. AIT is used across multiple NASA missions for ground data system (GDS) operations, telemetry monitoring, and spacecraft commanding. The AIT framework uses a modular ZeroMQ-based server architecture with inbound/outbound streams, handlers, and plugins, where AIT-GUI functions as a plugin providing a web-based REST API with Server-Sent Events for real-time telemetry.
Security researcher Yuval Elbar of Cycode discovered a critical vulnerability (GHSA-p9r8-2q67-fp86, CVSS 9.4, published August 13, 2026) comprising four distinct but compounding web application weaknesses in AIT-GUI versions through 2.5.1.
First, the AIT-GUI web server reads its configured host setting but silently discards it, hardcoding the listener to bind on 0.0.0.0 across all network interfaces on port 8080 (default) — a mission operator who configures host: localhost for loopback-only access inadvertently exposes the console to the entire reachable network, including potentially the internet depending on firewall rules. The vulnerable code in ait/gui/__init__.py reads host = getattr(self, 'host', 'localhost') then immediately discards it, constructing the WSGIServer with ("0.0.0.0", port).
Second, none of the application's state-changing routes enforce authentication, authorization, or CSRF protections. There is no login requirement, no session gate, no CSRF token, and no CORS restriction on any route. All state-changing endpoints accept application/x-www-form-urlencoded request bodies — a content type that browsers treat as CORS "simple" requests deliverable cross-origin without a preflight OPTIONS handshake.
Third, the POST /cmd endpoint (ait/gui/__init__.py line ~369) reads the command field from bottle.request.forms, splits it into arguments, uppercases the first token, and passes them directly to self.send() — which relays the command to the spacecraft command bus with zero validation of the command name, arguments, or sender authority.
Fourth, the POST /script/run and POST /seq endpoints (line ~1023) construct filesystem paths from unvalidated user input. The /seq endpoint joins bn_seqfile = bottle.request.forms.get("seqfile") to SEQRoot via os.path.join with no confinement — only an os.path.isfile check exists — then spawns a subprocess via gevent.subprocess.Popen(["ait-seq-send", seqfile], ...). Similarly, /script/run joins scriptPath to ScriptRoot without confinement checks. Notably, a correct path-confinement check already existed on the /scripts/load endpoint in the same codebase but was not reused on /seq or /script/run, exemplifying an inconsistent security posture within the same module.
A separately tracked related flaw, CVE-2026-60112 (CVSS 9.8 v3.1 / 9.3 v4.0), was published on July 28, 2026, and disclosed by Saidakbarxon Maxsudxonov via VulnCheck. This flaw describes a missing authentication vulnerability in the Sessions.create() endpoint (CWE-306), which performs no credential validation whatsoever. Any unauthenticated network attacker can call Sessions.create() to obtain a valid session, then invoke handle_cmd() to forward arbitrary commands directly to the AIT command bus with no authentication gate between session creation and command dispatch. This flaw is fixed in AIT-GUI 2.5.1 (commit beb8fc0, authored by Rat5ak), while the broader four-issue advisory is fixed in version 2.5.2.
Because the endpoints accept application/x-www-form-urlencoded request bodies, even a host-local or firewalled AIT-GUI deployment is exploitable via cross-site request forgery (CSRF, CWE-352). If a mission operator with
Weaknesses (CWE)
CWE-306, CWE-352, CWE-22
Target sectors: aerospace, space, defense, government administration, research, education
Target regions: Global, united states of america, Europe, japan, australia
Timeline
- AIT-GUI 2.5.0-rc1 removes Python pickle module (PR #263) — a known vector for arbitrary code execution via deserialization — and adds initial SonarQube-recommended path handling improvements
- NASA-AMMOS fix commit beb8fc0813eded89f985d3eb9a73535dd327726d is confirmed authored 2026-07-10, adding 18 regression tests that fail pre-fix and pass post-fix, and carrying a Co-Authored-By trailer crediting Anthropic's Claude Opus 4.8.
- Fix commit beb8fc0 authored by Rat5ak restricts script execution paths with canonicalization (resolve + is_relative_to) and eliminates static temp file usage in favor of tempfile.NamedTemporaryFile — addressing path traversal in /script/run and /seq
- AIT-GUI 2.5.1 released, fixing CVE-2026-60112 via commit beb8fc0. The release includes path traversal prevention, empty script name validation, and temp file hardening
- CVE-2026-60112 published by VulnCheck (credit: Saidakbarxon Maxsudxonov) and NVD. CVSS 9.8 v3.1 / 9.3 v4.0. GHSA-3j6g-pxmx-58qg published. CISA-ADP assigns SSVC: exploitation=none, automatable=yes, technicalImpact=total
- NIST adds CPE configuration cpe:2.3:a:nasa:ait_gui:*:*:*:*:*:*:*:* for CVE-2026-60112, enabling automated vulnerability scanning
- AIT-GUI 2.5.2 released, addressing the full breadth of vulnerabilities (GHSA-p9r8-2q67-fp86): authentication, authorization, CSRF protection, configured-host binding, and path confinement on all state-changing endpoints
- GHSA-p9r8-2q67-fp86 published. CybersecurityNews reports the critical AIT-GUI flaw to the public. CISA KEV does not add the CVE, and no active exploitation has been confirmed
- Cycode publishes full technical blog post by Yuval Elbar detailing all four compounded vulnerabilities, including source code excerpts, proof-of-concept commands (curl), and CSRF demonstration. IT Brief and Infosecurity Magazine cover the disclosure
- Expert Insights and additional outlets publish follow-up analysis. EPSS score of 0.408% (34th percentile) indicates growing awareness among security scanners
- NASA tells Infosecurity Magazine that JPL engineers confirmed and resolved the vulnerability in the open-source AMMOS AIT-GUI web API and points to its Bugcrowd program for future reports.
- Security Affairs publishes further coverage of the disclosure.
Detections & IOCs
As of 2026-09-06, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 14 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, CVE-2026-60112, T1595, T1590, T1190, T1059, T1204, T1046, T1005, T1071, T1529, T1489
