# NASA JPL AIT-GUI Missing Authentication and CSRF Flaw Allows Unauthenticated Spacecraft Command Injection (CVE-2026-60112, CVSS 9.8/9.4)

> A critical vulnerability (GHSA-p9r8-2q67-fp86, CVSS 9.4) in NASA/JPL's open-source AMMOS Instrument Toolkit GUI (AIT-GUI) — a browser-based spacecraft operator console — combines missing authentication, missing authorization, missing CSRF protection, hardcoded 0.0.0.0 network binding, and path traversal flaws on state-changing HTTP endpoints (/cmd, /script/run, /seq). An unauthenticated attacker on the network can issue arbitrary spacecraft commands, execute server-side scripts, and traverse the filesystem. A related session-creation flaw CVE-2026-60112 (CVSS 9.8) allows any unauthenticated attacker to obtain a valid session via Sessions.create() without credential checks and dispatch commands through the AIT command bus.

- **Published:** 2026-08-20T00:00:00Z
- **Last reviewed:** 2026-08-23T05:35:55.366Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2081
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-ait-gui-auth-bypass-tl-2026-2081.webp?v=cf21fe9a (Threadlinqs threat intel: CVE-2026-60112 NASA AIT-GUI Spacecraft Auth Bypass (TL-2026-2081) — Critical severity, 14 IOCs, 9 detection rules.)
- **ID:** TL-2026-2081
- **Severity:** CRITICAL (CVSS 9.4)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 14 (1 shown free below)
- **CVEs:** CVE-2026-60112

## Description

The AMMOS Instrument Toolkit GUI (AIT-GUI) is an open-source browser-based operator console developed by NASA's Jet Propulsion Laboratory (JPL) as part of the Advanced Multi-Mission Operations System (AMMOS) Instrument Toolkit (AIT). It serves as the primary human interface for commanding spacecraft and scientific instruments, translating operator button clicks into commands relayed to the AIT command bus and ultimately to flight hardware. AIT is used across multiple NASA missions for ground data system (GDS) operations, telemetry monitoring, and spacecraft commanding. The AIT framework uses a modular ZeroMQ-based server architecture with inbound/outbound streams, handlers, and plugins, where AIT-GUI functions as a plugin providing a web-based REST API with Server-Sent Events for real-time telemetry.

Security researcher Yuval Elbar of Cycode discovered a critical vulnerability (GHSA-p9r8-2q67-fp86, CVSS 9.4, published August 13, 2026) comprising four distinct but compounding web application weaknesses in AIT-GUI versions through 2.5.1.

First, the AIT-GUI web server reads its configured host setting but silently discards it, hardcoding the listener to bind on 0.0.0.0 across all network interfaces on port 8080 (default) — a mission operator who configures host: localhost for loopback-only access inadvertently exposes the console to the entire reachable network, including potentially the internet depending on firewall rules. The vulnerable code in ait/gui/__init__.py reads host = getattr(self, 'host', 'localhost') then immediately discards it, constructing the WSGIServer with ("0.0.0.0", port).

Second, none of the application's state-changing routes enforce authentication, authorization, or CSRF protections. There is no login requirement, no session gate, no CSRF token, and no CORS restriction on any route. All state-changing endpoints accept application/x-www-form-urlencoded request bodies — a content type that browsers treat as CORS "simple" requests deliverable cross-origin without a preflight OPTIONS handshake.

Third, the POST /cmd endpoint (ait/gui/__init__.py line ~369) reads the command field from bottle.request.forms, splits it into arguments, uppercases the first token, and passes them directly to self.send() — which relays the command to the spacecraft command bus with zero validation of the command name, arguments, or sender authority.

Fourth, the POST /script/run and POST /seq endpoints (line ~1023) construct filesystem paths from unvalidated user input. The /seq endpoint joins bn_seqfile = bottle.request.forms.get("seqfile") to SEQRoot via os.path.join with no confinement — only an os.path.isfile check exists — then spawns a subprocess via gevent.subprocess.Popen(["ait-seq-send", seqfile], ...). Similarly, /script/run joins scriptPath to ScriptRoot without confinement checks. Notably, a correct path-confinement check already existed on the /scripts/load endpoint in the same codebase but was not reused on /seq or /script/run, exemplifying an inconsistent security posture within the same module.

A separately tracked related flaw, CVE-2026-60112 (CVSS 9.8 v3.1 / 9.3 v4.0), was published on July 28, 2026, and disclosed by Saidakbarxon Maxsudxonov via VulnCheck. This flaw describes a missing authentication vulnerability in the Sessions.create() endpoint (CWE-306), which performs no credential validation whatsoever. Any unauthenticated network attacker can call Sessions.create() to obtain a valid session, then invoke handle_cmd() to forward arbitrary commands directly to the AIT command bus with no authentication gate between session creation and command dispatch. This flaw is fixed in AIT-GUI 2.5.1 (commit beb8fc0, authored by Rat5ak), while the broader four-issue advisory is fixed in version 2.5.2.

Because the endpoints accept application/x-www-form-urlencoded request bodies, even a host-local or firewalled AIT-GUI deployment is exploitable via cross-site request forgery (CSRF, CWE-352). If a mission operator with AIT-GUI open in their browser visits a malicious webpage, that page can silently submit a self-submitting HTML form to POST http://127.0.0.1:8080/cmd with command=NO_OP 1 2 3 — the browser delivers the request cross-origin without a preflight check, and the server executes it without a CSRF token or origin validation. This means no direct network connectivity to the AIT-GUI port is required for the CSRF attack vector; only the operator's browser access to the console is needed.

Practical proof-of-concept commands published in the disclosure demonstrate exploitation with basic curl against any reachable target:
- curl -i -X POST http://TARGET:8080/cmd --data-urlencode 'command=NO_OP 1 2 3'
- curl -i -X POST http://TARGET:8080/script/run --data-urlencode 'scriptPath=../../../../path/to/any/script'
- curl -i -X POST http://TARGET:8080/seq --data-urlencode 'seqfile=../../../../path/to/any/file'

The discovery methodology combined human researcher judgment with AI-assisted code analysis. The tool surfaced suspicious patterns across the codebase — routes with no auth decorators, tainted request.forms input flowing into dangerous sinks (os.path.join then subprocess.Popen), dead configuration writes where host was assigned then discarded, and unused safe patterns (the /scripts/load confinement check that /seq and /script/run failed to reuse). Each finding was confirmed by hand and reduced to a working proof-of-concept, including a self-contained CSRF demonstration using a real headless browser. As Yuval Elbar stated: "A pattern match tells you where to look; a reproduced exploit tells you it's real."

At the time of disclosure (August 2026), no active exploitation in the wild has been publicly confirmed. CISA's SSVC assessment for CVE-2026-60112 classifies the flaw as automatable with total technical impact, though exploitation status is listed as "none." The CISA Known Exploited Vulnerabilities (KEV) catalog does not include this CVE. The EPSS score of 0.408% (34th percentile) suggests growing awareness. The advisory affects 20+ industries that may use AIT-GUI or its parent AIT framework, including aerospace, defense, research institutions, and government agencies operating spacecraft ground systems.

Remediation requires upgrading to AIT-GUI 2.5.2 (pip install ait-gui==2.5.2), auditing command and sequence history for any pre-patch unauthorized activity, and confirming the console port is not reachable from untrusted networks. NASA-AMMOS released 2.5.2 on August 12, 2026, with durable fixes: authentication and authorization on all state-changing endpoints, CSRF protection either via tokens or rejecting CORS-simple content types, binding to the configured host (defaulting to localhost) instead of hardcoded 0.0.0.0, and path confinement using os.path.realpath canonicalization with is_relative_to checks to verify resolved paths stay within intended root directories. Earlier hardening in version 2.5.0-rc1 had already removed Python's pickle module (a known vector for arbitrary code execution during deserialization) and added some path handling improvements via SonarQube-recommended changes, but these were insufficient to prevent the discovered flaws.

This case underscores a critical gap in operational technology (OT) and space cybersecurity: ground-system and mission operations software inherits the same web application weaknesses as ordinary enterprise software, but the cost of a successful exploit is measured in real-world hardware actions against spacecraft and scientific instruments rather than data breaches. Four ordinary web flaws — no authentication, no CSRF protection, path traversal, and a network configuration error — compose into an exploit chain that threatens active space missions. The vulnerability is particularly significant because AIT is open-source software used across multiple NASA and partner missions, making the attack surface potentially broader than a single proprietary system.

## MITRE ATT&CK

- T1595 Active Scanning
- T1590 Gather Victim Network Information
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1204 User Execution
- T1046 Network Service Discovery
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1529 System Shutdown/Reboot
- T1489 Service Stop
- T1565 Data Manipulation
- T1490 Inhibit System Recovery
- T0883 Internet Accessible Device
- T1189 Drive-by Compromise
- T1204.001 User Execution
- T0863 User Execution
- T0853 Scripting
- T0871 Execution through API
- T0855 Unauthorized Command Message
- T0836 Modify Parameter

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**External Network Reconnaissance Targeting AIT-GUI Port 8080** (`TL-2026-2081-SPL-003`)

Detects network scanning or reconnaissance activity targeting TCP port 8080 on AIT-GUI server infrastructure. AIT-GUI hardcodes its listener to bind on 0.0.0.0:8080 regardless of the configured host setting, exposing the console web API to all reachable network interfaces. Attackers use active scanning (T1595) and network service discovery (T1046) to identify exposed AIT-GUI instances as a precursor to exploitation via unauthenticated /cmd, /script/run, or /seq endpoints.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1046, T1595, T1590
- **Data sources:** firewall_logs, ids_ips, netflow
- **Severity:** medium
- **Confidence:** high

### Splunk SPL

```spl
index=network sourcetype=firewall dest_port=8080 action=allowed
| eval threat_id="TL-2026-2081", mitre_techniques="T1046|T1595|T1590"
| stats dc(src_ip) as unique_sources, count as total_hits, values(src_ip) as source_ips by dest_ip
| where unique_sources >= 3 OR total_hits >= 20
| eval severity=case(unique_sources>=10,"critical", unique_sources>=5,"high", 1=1,"medium")
| eval alert_description= "AIT-GUI port 8080 connection burst from " . unique_sources . " unique sources"
| table dest_ip, unique_sources, total_hits, source_ips, severity, alert_description, mitre_techniques
| sort - unique_sources
| rename dest_ip as "AIT-GUI Server", unique_sources as "Unique Sources", total_hits as "Total Connections"
```

### Microsoft KQL

```kql
CommonSecurityLog
| where DevicePort == 8080
| where DeviceAction == "Allow"
| where CommunicationDirection == "Inbound" or CommunicationDirection == 0
| extend ThreatId = "TL-2026-2081"
| extend MitreTechniques = "T1046, T1595, T1590"
| summarize UniqueSources = dcount(SourceIP), TotalConnections = count(), SourceIPs = make_set(SourceIP, 10) by DestinationIP, ThreatId, MitreTechniques
| where UniqueSources >= 3 or TotalConnections >= 20
| extend Severity = case(UniqueSources >= 10, "critical", UniqueSources >= 5, "high", "medium")
| project DestinationIP, UniqueSources, TotalConnections, SourceIPs, Severity, ThreatId, MitreTechniques
| order by UniqueSources desc
```

### Sigma

```yaml
title: External Network Reconnaissance Targeting AIT-GUI Port 8080
id: e5a1b9c3-0d6f-4b34-9e8g-4c7a0d3b5e9f
status: experimental
description: Detects multiple unique source IPs or high connection counts targeting TCP port 8080 (default AIT-GUI HTTP listener) on hosts in the ground-system network. AIT-GUI hardcodes its server to bind on 0.0.0.0:8080, exposing the spacecraft console web API to all reachable networks. Scanning for port 8080 is a precursor to unauthenticated command injection (T1190).
references:
    - https://attack.mitre.org/techniques/T1046/
    - https://attack.mitre.org/techniques/T1595/
    - https://cycode.com/blog/ait-gui-unauthenticated-command-execution/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/08/20
tags:
    - attack.reconnaissance
    - attack.t1595
    - attack.t1590
    - attack.discovery
    - attack.t1046
    - cve.2026.60112
logsource:
    category: firewall
    product: generic
detection:
    selection:
        destination.port: 8080
        network.protocol: tcp
        event.action: allowed
    condition: selection
    condition_aggregation:
        unique_count(src.ip) >= 3 OR event_count >= 20
        timeframe: 15m
falsepositives:
    - Routine vulnerability scanning or configuration management tools targeting ground-system infrastructure
    - Legitimate monitoring systems performing port health checks
level: medium
```

**Known false positives:**

- Authorized vulnerability scanning windows
- Configuration management and asset discovery tools
- Network monitoring and observability platforms

**Tuning notes:** Create allowlists for authorized scanners and monitoring infrastructure. Correlate scanning bursts with firewall allow/deny ratio — scanning from internet-routable IPs with no prior association to the organization is high-fidelity. Escalate to high/critical if scanning is followed by POST requests to /cmd or /script/run from the same source within 24 hours.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- AIT-GUI Sessions.create() Authentication Bypass and Session Abuse (locked: unlock with TL Creds)
- Anomalous Process Execution on AIT-GUI Server — ait-seq-send and Script Subprocess Abuse (locked: unlock with TL Creds)
- Cross-Site Request Forgery (CSRF) Targeting AIT-GUI on Loopback Interface (locked: unlock with TL Creds)
- AIT-GUI Exploitation via Automated Tooling and Curl-Based Command Injection (locked: unlock with TL Creds)
- AIT-GUI File Discovery via Path Traversal on /script/run and /seq (locked: unlock with TL Creds)
- Unusual Application Layer Protocol Traffic to AIT-GUI Ground System Port 8080 (locked: unlock with TL Creds)
- AIT-GUI Unauthenticated Command Injection via /cmd Endpoint (locked: unlock with TL Creds)
- AIT-GUI Path Traversal Exploitation via /script/run and /seq Endpoints (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (1 of 14)

Defanged, TLP:CLEAR.

- File hash: `beb8fc0813eded89f985d3eb9a73535dd327726d`

Full set of 14 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Cycode Blog — AIT-GUI Unauthenticated Command Execution (Full Technical Disclosure)](https://cycode.com/blog/ait-gui-unauthenticated-command-execution/)
- [GHSA-p9r8-2q67-fp86 — AIT-GUI Unauthenticated Command Execution](https://github.com/advisories/GHSA-p9r8-2q67-fp86)
- [CVE-2026-60112 — NVD Detail (CVSS 9.8)](https://nvd.nist.gov/vuln/detail/CVE-2026-60112)
- [GHSA-3j6g-pxmx-58qg — Missing Authentication via Sessions.create()](https://github.com/advisories/GHSA-3j6g-pxmx-58qg)
- [VulnCheck Advisory — CVE-2026-60112 AIT-GUI < 2.5.1](https://www.vulncheck.com/advisories/ait-gui-missing-authentication-via-sessions-create)
- [Fix Commit beb8fc0 — Path traversal prevention and temp file hardening](https://github.com/NASA-AMMOS/AIT-GUI/commit/beb8fc0813eded89f985d3eb9a73535dd327726d)
- [AIT-GUI Release 2.5.1 — GitHub Release](https://github.com/NASA-AMMOS/AIT-GUI/releases/tag/2.5.1)
- [CybersecurityNews — NASA AIT-GUI Critical Vulnerability](https://cybersecuritynews.com/nasa-ait-gui-flaw/)
- [IT Brief — NASA JPL Console Flaw Allows Unauthorised Commands](https://itbrief.com.au/story/nasa-lab-console-flaw-allows-unauthorised-commands)
- [Expert Insights — NASA Software Flaw: Unauthorized Spacecraft Commands](https://expertinsights.com/news/nasa-software-flaw-unauthorized-commands)
- [Infosecurity Magazine — NASA Ground Control Software Flaw Enables Unauthenticated Commands](https://www.infosecurity-magazine.com/news/nasa-ait-gui-critical-flaw/)
- [NASA-AMMOS AIT-GUI GitHub Repository](https://github.com/NASA-AMMOS/AIT-GUI)
- [NASA-AMMOS AIT-Core GitHub Repository (AIT Framework)](https://github.com/NASA-AMMOS/AIT-Core)
- [AIT-Core Documentation — Server Architecture](https://ait-core.readthedocs.io/en/latest/server_architecture.html)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2081