NASA JPL AIT-GUI Missing Authentication and CSRF Flaw Allows Unauthenticated Spacecraft Command Injection (CVE-2026-60112, CVSS 9.8/9.4)
NASA JPL AIT-GUI Missing Authentication and CSRF Flaw Allows (TL-2026-2081), also tracked as GHSA-p9r8-2q67-fp86, is a critical-severity software vulnerability scored CVSS 9.4, first published 2026-08-20 and last reviewed 2026-08-23. It has no confirmed attribution, affects NASA/Jet Propulsion Laboratory (JPL) AIT-GUI (AMMOS Instrument Toolkit, references 1 CVE (CVE-2026-60112), maps to 20 MITRE ATT&CK techniques (T0836, T0853, T0855), and is covered by 9 detection rules and 14 indicators of compromise.
Key facts for TL-2026-2081
- Threat ID
- TL-2026-2081
- Also known as
- GHSA-p9r8-2q67-fp86, GHSA-3j6g-pxmx-58qg, AIT-GUI Unauthenticated Command Execution
- Severity
- CRITICAL
- CVSS
- 9.4 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- 2026-08-20
- Last reviewed
- 2026-08-23
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- aerospace, space, defense, government administration, research, education
- Target regions
- Global, united states of america, Europe, japan, australia
- Detection rules
- 9
- Indicators of compromise
- 14
- Updates
- 2026-08-23 · revalidated 1× · latest source
Malware and tooling in NASA JPL AIT-GUI Missing Authentication and CSRF Flaw Allows
Malware and tooling: Python, ait-gui
A critical vulnerability (GHSA-p9r8-2q67-fp86, CVSS 9.4) in NASA/JPL's open-source AMMOS Instrument Toolkit GUI (AIT-GUI) — a browser-based spacecraft operator console — combines missing authentication, missing authorization, missing CSRF protection, hardcoded 0.0.0.0 network binding, and path traversal flaws on state-changing HTTP endpoints (/cmd, /script/run, /seq). An unauthenticated attacker on the network can issue arbitrary spacecraft commands, execute server-side scripts, and traverse the filesystem. A related session-creation flaw CVE-2026-60112 (CVSS 9.8) allows any unauthenticated attacker to obtain a valid session via Sessions.create() without credential checks and dispatch commands through the AIT command bus.
How NASA JPL AIT-GUI Missing Authentication and CSRF Flaw Allows works
The AMMOS Instrument Toolkit GUI (AIT-GUI) is an open-source browser-based operator console developed by NASA's Jet Propulsion Laboratory (JPL) as part of the Advanced Multi-Mission Operations System (AMMOS) Instrument Toolkit (AIT). It serves as the primary human interface for commanding spacecraft and scientific instruments, translating operator button clicks into commands relayed to the AIT command bus and ultimately to flight hardware. AIT is used across multiple NASA missions for ground data system (GDS) operations, telemetry monitoring, and spacecraft commanding. The AIT framework uses a modular ZeroMQ-based server architecture with inbound/outbound streams, handlers, and plugins, where AIT-GUI functions as a plugin providing a web-based REST API with Server-Sent Events for real-time telemetry.
Security researcher Yuval Elbar of Cycode discovered a critical vulnerability (GHSA-p9r8-2q67-fp86, CVSS 9.4, published August 13, 2026) comprising four distinct but compounding web application weaknesses in AIT-GUI versions through 2.5.1.
First, the AIT-GUI web server reads its configured host setting but silently discards it, hardcoding the listener to bind on 0.0.0.0 across all network interfaces on port 8080 (default) — a mission operator who configures host: localhost for loopback-only access inadvertently exposes the console to the entire reachable network, including potentially the internet depending on firewall rules. The vulnerable code in ait/gui/__init__.py reads host = getattr(self, 'host', 'localhost') then immediately discards it, constructing the WSGIServer with ("0.0.0.0", port).
Second, none of the application's state-changing routes enforce authentication, authorization, or CSRF protections. There is no login requirement, no session gate, no CSRF token, and no CORS restriction on any route. All state-changing endpoints accept application/x-www-form-urlencoded request bodies — a content type that browsers treat as CORS "simple" requests deliverable cross-origin without a preflight OPTIONS handshake.
Third, the POST /cmd endpoint (ait/gui/__init__.py line ~369) reads the command field from bottle.request.forms, splits it into arguments, uppercases the first token, and passes them directly to self.send() — which relays the command to the spacecraft command bus with zero validation of the command name, arguments, or sender authority.
Fourth, the POST /script/run and POST /seq endpoints (line ~1023) construct filesystem paths from unvalidated user input. The /seq endpoint joins bn_seqfile = bottle.request.forms.get("seqfile") to SEQRoot via os.path.join with no confinement — only an os.path.isfile check exists — then spawns a subprocess via gevent.subprocess.Popen(["ait-seq-send", seqfile], ...). Similarly, /script/run joins scriptPath to ScriptRoot without confinement checks. Notably, a correct path-confinement check already existed on the /scripts/load endpoint in the same codebase but was not reused on /seq or /script/run, exemplifying an inconsistent security posture within the same module.
A separately tracked related flaw, CVE-2026-60112 (CVSS 9.8 v3.1 / 9.3 v4.0), was published on July 28, 2026, and disclosed by Saidakbarxon Maxsudxonov via VulnCheck. This flaw describes a missing authentication vulnerability in the Sessions.create() endpoint (CWE-306), which performs no credential validation whatsoever. Any unauthenticated network attacker can call Sessions.create() to obtain a valid session, then invoke handle_cmd() to forward arbitrary commands directly to the AIT command bus with no authentication gate between session creation and command dispatch. This flaw is fixed in AIT-GUI 2.5.1 (commit beb8fc0, authored by Rat5ak), while the broader four-issue advisory is fixed in version 2.5.2.
Because the endpoints accept application/x-www-form-urlencoded request bodies, even a host-local or firewalled AIT-GUI deployment is exploitable via cross-site request forgery (CSRF, CWE-352). If a mission operator with AIT-GUI open in their browser visits a malicious webpage, that page can silently submit a self-submitting HTML form to POST http://127.0.0.1:8080/cmd with command=NO_OP 1 2 3 — the browser delivers the request cross-origin without a preflight check, and the server executes it without a CSRF token or origin validation. This means no direct network connectivity to the AIT-GUI port is required for the CSRF attack vector; only the operator's browser access to the console is needed.
Practical proof-of-concept commands published in the disclosure demonstrate exploitation with basic curl against any reachable target: - curl -i -X POST http://TARGET:8080/cmd --data-urlencode 'command=NO_OP 1 2 3' - curl -i -X POST http://TARGET:8080/script/run --data-urlencode 'scriptPath=../../../../path/to/any/script' - curl -i -X POST http://TARGET:8080/seq --data-urlencode 'seqfile=../../../../path/to/any/file'
The discovery methodology combined human researcher judgment with AI-assisted code analysis. The tool surfaced suspicious patterns across the codebase — routes with no auth decorators, tainted request.forms input flowing into dangerous sinks (os.path.join then subprocess.Popen), dead configuration writes where host was assigned then discarded, and unused safe patterns (the /scripts/load confinement check that /seq and /script/run failed to reuse). Each finding was confirmed by hand and reduced to a working proof-of-concept, including a self-contained CSRF demonstration using a real headless browser. As Yuval Elbar stated: "A pattern match tells you where to look; a reproduced exploit tells you it's real."
At the time of disclosure (August 2026), no active exploitation in the wild has been publicly confirmed. CISA's SSVC assessment for CVE-2026-60112 classifies the flaw as automatable with total technical impact, though exploitation status is listed as "none." The CISA Known Exploited Vulnerabilities (KEV) catalog does not include this CVE. The EPSS score of 0.408% (34th percentile) suggests growing awareness. The advisory affects 20+ industries that may use AIT-GUI or its parent AIT framework, including aerospace, defense, research institutions, and government agencies operating spacecraft ground systems.
Remediation requires upgrading to AIT-GUI 2.5.2 (pip install ait-gui==2.5.2), auditing command and sequence history for any pre-patch unauthorized activity, and confirming the console port is not reachable from untrusted networks. NASA-AMMOS released 2.5.2 on August 12, 2026, with durable fixes: authentication and authorization on all state-changing endpoints, CSRF protection either via tokens or rejecting CORS-simple content types, binding to the configured host (defaulting to localhost) instead of hardcoded 0.0.0.0, and path confinement using os.path.realpath canonicalization with is_relative_to checks to verify resolved paths stay within intended root directories. Earlier hardening in version 2.5.0-rc1 had already removed Python's pickle module (a known vector for arbitrary code execution during deserialization) and added some path handling improvements via SonarQube-recommended changes, but these were insufficient to prevent the discovered flaws.
This case underscores a critical gap in operational technology (OT) and space cybersecurity: ground-system and mission operations software inherits the same web application weaknesses as ordinary enterprise software, but the cost of a successful exploit is measured in real-world hardware actions against spacecraft and scientific instruments rather than data breaches. Four ordinary web flaws — no authentication, no CSRF protection, path traversal, and a network configuration error — compose into an exploit chain that threatens active space missions. The vulnerability is particularly significant because AIT is open-source software used across multiple NASA and partner missions, making the attack surface potentially broader than a single proprietary system.
MITRE ATT&CK techniques used in TL-2026-2081
Impair Process Control
T0836 Modify Parameter; T0855 Unauthorized Command Message
Execution
T0853 Scripting; T0863 User Execution; T0871 Execution through API; T1059 Command and Scripting Interpreter; T1204 User Execution; T1204.001 User Execution
Initial Access
T0883 Internet Accessible Device; T1189 Drive-by Compromise; T1190 Exploit Public-Facing Application
Collection
Discovery
T1046 Network Service Discovery
Command and Control
T1071 Application Layer Protocol
Impact
T1489 Service Stop; T1490 Inhibit System Recovery; T1529 System Shutdown/Reboot; T1565 Data Manipulation
Reconnaissance
T1590 Gather Victim Network Information; T1595 Active Scanning
Affected products and versions in NASA JPL AIT-GUI Missing Authentication and CSRF Flaw Allows
- NASA/Jet Propulsion Laboratory (JPL) — AIT-GUI (AMMOS Instrument Toolkit Graphical User Interface)
Vulnerable versions: <=2.5.1 (GHSA-p9r8-2q67-fp86 — auth+CSRF+traversal+bind); <2.5.1 (CVE-2026-60112 — session creation flaw)
Fixed in: 2.5.1 (CVE-2026-60112 only); 2.5.2 (all issues) - NASA/JPL — AMMOS Instrument Toolkit (AIT-Core) — when AIT-GUI plugin is enabled
Vulnerable versions: All versions bundling or using AIT-GUI <=2.5.1
Fixed in: AIT-GUI >=2.5.2
Remediation for NASA JPL AIT-GUI Missing Authentication and CSRF Flaw Allows
Patches
- Upgrade to AIT-GUI 2.5.2: pip install ait-gui==2.5.2
- For CVE-2026-60112 specifically: upgrade to AIT-GUI 2.5.1 at minimum (commit beb8fc0813eded89f985d3eb9a73535dd327726d)
Immediate actions
- Upgrade AIT-GUI to version 2.5.2 or later via pip install ait-gui==2.5.2
- Restrict network access to AIT-GUI port 8080 to trusted hosts only using network ACLs or host-based firewalls
- Verify AIT-GUI is not reachable from untrusted networks or the internet by scanning for exposed instances
- Review command and sequence history (GET /cmd/hist.json, /log) for any pre-patch unauthorized commands or script executions
- Audit server access logs for suspicious POST requests to /cmd, /script/run, or /seq from unexpected sources
- Deploy network-level ACLs blocking port 8080 from untrusted network segments as immediate compensating control
Workarounds
- Deploy a reverse proxy (nginx, Apache, or cloud load balancer) with authentication in front of AIT-GUI until upgrade is possible
- Use host-based firewall (iptables, nftables, Windows Firewall) to restrict AIT-GUI to localhost only: iptables -A INPUT -p tcp --dport 8080 -s 127.0.0.1 -j ACCEPT; iptables -A INPUT -p tcp --dport 8080 -j DROP
- Place AIT-GUI instances on isolated management VLANs with strict egress filtering
- Disable or remove AIT-GUI plugin from AIT-Core if not actively needed for operations
Longer-term hardening
- Implement authentication and authorization (e.g., OAuth2, mTLS) on all state-changing HTTP endpoints in operational technology web interfaces
- Add CSRF protection via anti-CSRF tokens or require non-CORS-simple content types (application/json) on sensitive routes
- Bind server to configured host (default localhost) instead of hardcoded 0.0.0.0; validate host binding at startup
- Canonicalize file paths with os.path.realpath and verify resolved paths stay within allowed root directories using is_relative_to checks
- Establish uniform security patterns across all endpoints — reuse confinement, auth, and CSRF protection consistently
- Adopt AI-assisted static code analysis for continuous vulnerability discovery in ground-system software
- Implement CI/CD security gates for open-source mission software including SAST, dependency scanning, and secret detection
- Conduct regular independent security audits and penetration tests of ground data systems
- Develop secure-by-default configurations: fail-closed on auth, bind to loopback by default, whitelist file system paths
CVEs associated with NASA JPL AIT-GUI Missing Authentication and CSRF Flaw Allows
CVE-2026-60112
Weaknesses (CWE) in NASA JPL AIT-GUI Missing Authentication and CSRF Flaw Allows
CWE-306, CWE-352, CWE-22
Timeline of NASA JPL AIT-GUI Missing Authentication and CSRF Flaw Allows
- AIT-GUI 2.5.0-rc1 removes Python pickle module (PR #263) — a known vector for arbitrary code execution via deserialization — and adds initial SonarQube-recommended path handling improvements
- NASA-AMMOS fix commit beb8fc0813eded89f985d3eb9a73535dd327726d is confirmed authored 2026-07-10, adding 18 regression tests that fail pre-fix and pass post-fix, and carrying a Co-Authored-By trailer crediting Anthropic's Claude Opus 4.8.
- AIT-GUI 2.5.1 released, fixing CVE-2026-60112 via commit beb8fc0. The release includes path traversal prevention, empty script name validation, and temp file hardening
- Fix commit beb8fc0 authored by Rat5ak restricts script execution paths with canonicalization (resolve + is_relative_to) and eliminates static temp file usage in favor of tempfile.NamedTemporaryFile — addressing path traversal in /script/run and /seq
- NIST adds CPE configuration cpe:2.3:a:nasa:ait_gui:*:*:*:*:*:*:*:* for CVE-2026-60112, enabling automated vulnerability scanning
- CVE-2026-60112 published by VulnCheck (credit: Saidakbarxon Maxsudxonov) and NVD. CVSS 9.8 v3.1 / 9.3 v4.0. GHSA-3j6g-pxmx-58qg published. CISA-ADP assigns SSVC: exploitation=none, automatable=yes, technicalImpact=total
- AIT-GUI 2.5.2 released, addressing the full breadth of vulnerabilities (GHSA-p9r8-2q67-fp86): authentication, authorization, CSRF protection, configured-host binding, and path confinement on all state-changing endpoints
- GHSA-p9r8-2q67-fp86 published. CybersecurityNews reports the critical AIT-GUI flaw to the public. CISA KEV does not add the CVE, and no active exploitation has been confirmed
- Cycode publishes full technical blog post by Yuval Elbar detailing all four compounded vulnerabilities, including source code excerpts, proof-of-concept commands (curl), and CSRF demonstration. IT Brief and Infosecurity Magazine cover the disclosure
- Expert Insights and additional outlets publish follow-up analysis. EPSS score of 0.408% (34th percentile) indicates growing awareness among security scanners
- NASA tells Infosecurity Magazine that JPL engineers confirmed and resolved the vulnerability in the open-source AMMOS AIT-GUI web API and points to its Bugcrowd program for future reports.
- Security Affairs publishes further coverage of the disclosure.
Update history for TL-2026-2081
- 2026-08-23 — Critical Unauthenticated Command Execution in NASA/JPL AIT-GUI Spacecraft Command Software (GHSA-p9r8-2q67-fp86, CVE-2026-60112): What changed Status ACTIVE → PATCHED: AIT-GUI 2.5.2 (released 2026-08-12) is confirmed by NASA as the fix, per its 2026-08-21 statement to Infosecurity Magazine. Severity, CVSS score, and exploitability are unchanged (CRITICAL / 9.4 / POC_P
Sources cited for NASA JPL AIT-GUI Missing Authentication and CSRF Flaw Allows
- Cycode Blog — AIT-GUI Unauthenticated Command Execution (Full Technical Disclosure)
- GHSA-p9r8-2q67-fp86 — AIT-GUI Unauthenticated Command Execution
- CVE-2026-60112 — NVD Detail (CVSS 9.8)
- GHSA-3j6g-pxmx-58qg — Missing Authentication via Sessions.create()
- VulnCheck Advisory — CVE-2026-60112 AIT-GUI < 2.5.1
- Fix Commit beb8fc0 — Path traversal prevention and temp file hardening
- AIT-GUI Release 2.5.1 — GitHub Release
- CybersecurityNews — NASA AIT-GUI Critical Vulnerability
- IT Brief — NASA JPL Console Flaw Allows Unauthorised Commands
- Expert Insights — NASA Software Flaw: Unauthorized Spacecraft Commands
- Infosecurity Magazine — NASA Ground Control Software Flaw Enables Unauthenticated Commands
- NASA-AMMOS AIT-GUI GitHub Repository
- NASA-AMMOS AIT-Core GitHub Repository (AIT Framework)
- AIT-Core Documentation — Server Architecture
More in vulnerability
- Click2Shell WordPress Exploit Chain Lets Attackers Gain RCE With a Single Malicious Link
- SolarWinds Access Rights Manager Hard-Coded Cryptographic Key (CVE-2026-28326) Enables Unauthenticated RCE
- CISA Flags Three Actively Exploited Linux Kernel Vulnerabilities: kTLS Receive-Path Disclosure/DoS, ebtables SNAT Privilege Escalation, and AF_ALG Race Condition (CVE-2025-39682, CVE-2026-53266, CVE-2025-39964)
- Critical Pre-Auth RCE in Orkes Conductor Workflow Platform (CVE-2026-58138) Exploited in the Wild
- "LPE Quartet": Public Exploits Released for Four Linux Kernel Local-Root Flaws (DirtyAH6, TUNderflow, PPPoEject, DiagSpill)
Detection coverage for TL-2026-2081
As of 2026-08-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2081 across Splunk SPL, Microsoft KQL and Sigma, covering 14 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.