NASA AIT-GUI Flaws Could Let Unauthenticated Attackers Issue Spacecraft Commands

Summary: Cycode disclosed a chain of flaws in AIT-GUI, the browser-based operator console for NASA/JPL's open-source AMMOS Instrument Toolkit, tracked as GHSA-p9r8-2q67-fp86 and rated 9.4 on CVSS v3.1, affecting versions 2.5.1 and earlier with 2.5.2 listed as the fixed release. The advisory, published August 13, 2026 with no CVE assigned, describes a server that binds to 0.0.0.0 on port 8080 by default and exposes command, script, and sequence routes without credential-based authentication or CSRF protection, where a session cookie can be obtained by requesting the root page.
What you should know: An unauthenticated party who can reach port 8080 can issue arbitrary commands to the spacecraft and instrument command bus, and The Hacker News confirmed against the tagged 2.5.2 source that the release restricts where the console listens and blocks browser-driven cross-origin requests but does not add authentication to the command, script, or sequence endpoints.

Read the original at The Hacker News ↗