Security researchers from Cycode have disclosed a chain of vulnerabilities in AIT-GUI, the browser-based operator console for the open framework AMMOS Instrument Toolkit (NASA/JPL), designed for building ground control systems for spacecraft and instruments. The chain, tracked as GHSA-p9r8-2q67-fp86 with a score of 9.4 under CVSS v3.1, allows an unauthenticated attacker to send arbitrary commands to the software’s command bus. Versions 2.5.1 and earlier are affected; a fix is claimed in version 2.5.2, but source code analysis shows that authentication on key endpoints is still missing. No exploitation in real-world conditions has been recorded so far.
Technical nature of the vulnerabilities
According to the researchers, the AIT-GUI web server reads the configured host value but then ignores it, binding the listener to the hard-coded address 0.0.0.0 on port 8080. This means the server accepts connections on all network interfaces. At the same time, all routes that change system state are accessible without authentication, authorization, or protection against cross-site request forgery (CSRF).
The vulnerabilities are classified under three CWE categories:
- CWE-306 – missing authentication for critical functions
- CWE-352 – cross-site request forgery (CSRF)
- CWE-22 – path traversal
An unauthenticated attacker with network access to the port can:
- Send arbitrary commands to instruments and spacecraft via
POST /cmd - Run server-side scripts via
POST /script/run, including files outside the allowed directory through path traversal - Execute command sequences via
POST /seq, passing files from arbitrary directories into the subprocess
The CSRF attack vector is particularly dangerous. Since the routes accept request bodies in application/x-www-form-urlencoded format, browsers treat them as CORS “simple” requests and send them without a preliminary OPTIONS request. According to the researchers, if an operator with access to the console opens an attacker-controlled page in the browser, the cross-site POST request will be delivered and processed by the server — even when deployed behind a firewall.
Incomplete fix in version 2.5.2
AIT-GUI 2.5.2 was released on August 12, 2026. According to the changelog, it implements three key improvements:
- Binding to the configured host (by default, localhost instead of 0.0.0.0)
- Origin/Referer checks against Host for POST, PUT, DELETE, and PATCH requests to protect against CSRF
- Restricting the
/script/runand/seqroutes to configured root directories
However, analysis of the 2.5.2 source code showed that authentication was not added to the command, script, and sequence endpoints. The root route still calls Sessions.create() and issues a session cookie to any request without verifying credentials, and the command route accepts any request that carries this cookie. Thus, the fix reduces the attack surface but does not eliminate the fundamental problem of missing authentication.
Conflict between vulnerability records
The situation is complicated by the existence of a parallel vulnerability record. CVE-2026-60112, scored at 9.3 under CVSS v4 and published on July 29, 2026 — three weeks before the Cycode report — describes the same missing-authentication flaw. However, the records differ in their definition of affected versions: VulnCheck and the NVD entry state that the vulnerability affects versions up to 2.5.1 and reference commit beb8fc0 as the patch, whereas Cycode considers 2.5.1 vulnerable and names 2.5.2 as the fixed version. At the same time, analysis of the source code for both versions shows that unauthenticated session issuance is present in both 2.5.1 and 2.5.2.
Additionally, part of the stated scope of the vulnerability in the Cycode report may be overstated: analysis of the 2.5.1 source code showed that the /script/run route already includes canonicalization and path nesting checks of the type recommended by the report itself. In 2.5.1, the unconstrained path construction exists only on the /seq route.
The problem of distribution via PyPI
A critically important aspect: the latest version of the ait-gui package on PyPI is 2.4.1, uploaded on July 27, 2023. Versions 2.5.0, 2.5.1, and 2.5.2 are absent from the PyPI release history. This means that users installing the package via pip receive a version with a hard-coded binding to 0.0.0.0 and unconstrained path construction on both routes. At the same time, PyPI does not display vulnerability information for this package, and none of the vulnerability records are integrated into Dependabot.
Broader security context of NASA ground software
AIT-GUI is not the only NASA ground software component with unresolved security issues. The GitHub Advisory database contains records of several vulnerabilities in related projects, including path traversal in the AMMOS Instrument Toolkit (CVE-2026-47731), critical vulnerabilities in the NASA-AMMOS Aerie/PlanDev sequencing server (CVE-2026-71214), and in the reference implementation of the Asynchronous Network Management System (CVE-2026-71289).
CVE-2024-35058 merits particular attention — a critical remote code execution vulnerability in the API wait function of the NASA AIT-Core library, published in May 2024. It affects versions up to and including 2.5.2, and its record in the GitHub Advisory Database still lists no fixed versions.
Recommendations
Organizations using AIT-GUI should take the following steps:
- Immediately check whether AIT-GUI port 8080 is accessible from untrusted networks and restrict access using network segmentation controls
- Update to version 2.5.2 from the GitHub repository (not via PyPI, where the current version is unavailable), bearing in mind that this reduces but does not eliminate risk
- Place a reverse proxy server with full authentication in front of AIT-GUI, since the server itself does not implement credential checks
- Restrict console operators’ access to external web resources to minimize the risk of CSRF attacks
- Audit deployed AIT-Core instances for CVE-2024-35058, for which no patch is available
The AIT-GUI situation illustrates a systemic problem: software used to control critical space infrastructure, originally developed for isolated environments, becomes vulnerable when the deployment model changes. Discrepancies between vulnerability records, the absence of current versions on PyPI, and the incomplete nature of the 2.5.2 patch mean that, for now, the only reliable protective measure is to place an external authentication layer in front of all AIT-GUI instances, regardless of the installed version.
