Security researchers at **Cycode** have disclosed a chain of critical flaws in **AIT-GUI**, the browser-based operator console for **NASA/JPL**'s open-source **AMMOS Instrument Toolkit**. These vulnerabilities could allow an unauthenticated attacker to issue arbitrary commands to the software's spacecraft and instrument command bus.  ### The Vulnerability Chain: GHSA-p9r8-2q67-fp86 The identified chain, tracked as **GHSA-p9r8-2q67-fp86**, has a severity rating of 9.4 on the **CVSS v3.1** scoring system. It impacts **AIT-GUI** versions 2.5.1 and earlier, with version 2.5.2 cited as the fixed release. Despite its critical nature, no **CVE** has been assigned to this specific **Cycode** finding, though a related **CVE-2026-60112** exists. **AMMOS Instrument Toolkit** is a crucial framework for building ground data systems, responsible for sending commands to instruments and spacecraft and processing telemetry. **AIT-GUI** serves as its operator console, with the vulnerable endpoints relaying commands to a command bus. "The blast radius of an unauthenticated POST is measured in issued instrument commands, not defaced pages," **Cycode** stated in their comprehensive writeup. ### Technical Breakdown of the Flaws The **AIT-GUI** web server, by default, binds its listener to `0.0.0.0` on port 8080, exposing command, script, and sequence routes without requiring credential-based authentication or authorization. Crucially, it also lacks cross-site request forgery (**CSRF**) protection. While a session cookie gates these routes, a session can be obtained without credentials simply by requesting the root page. Two of the affected routes also construct filesystem paths from unvalidated input, leading to path traversal vulnerabilities. These issues are classified under **CWE-306** (Missing Authentication for Critical Function), **CWE-352** (Cross-Site Request Forgery), and **CWE-22** (Path Traversal). An unauthenticated attacker who can reach the port could: * Issue arbitrary instrument and spacecraft commands via `POST /cmd`. * Execute server-side scripts via `POST /script/run`, including files outside the intended directory via path traversal. * Run command sequences via `POST /seq`, including out-of-directory files passed to a subprocess. **Yuval Elbar**, a security researcher at **Cycode**, highlighted the severity: "A web GUI used to drive spacecraft and instrument commanding shipped a server that listens on every network interface, asks nobody for a password, and can be steered by any web page an operator happens to open." ### Partial Remediation and Ongoing Concerns **AIT-GUI** version 2.5.2, released on August 12, 2026, introduced several fixes. It now binds to the configured host (defaulting to `localhost`), adds a `before_request` hook to compare `Origin`/`Referer` headers against the server's `Host` for state-changing requests (POST, PUT, DELETE, PATCH), and confines `/script/run` and `/seq` to their configured roots. However, upon review of the 2.5.2 source, it was found that the root route still calls `Sessions.create()` and issues a session cookie without credential checks. The command route continues to accept any request carrying this cookie. **Cycode** confirmed that, while the 2.5.2 release addresses remote exposure and cross-site delivery paths, it does not fully remediate the fundamental missing-authentication weakness. ### Discrepancies and Overlapping Discoveries Separately, **CVE-2026-60112**, rated 9.3 on **CVSS v4** and credited to **Saidakbarxon Maxsudxonov**, was published on July 29, 2026, covering the same missing-authentication defect. This **CVE** and the **Cycode** advisory differ on the precise fix and affected versions, with **Cycode** viewing its finding as a distinct, broader chain of vulnerabilities. Notably, the **GHSA-p9r8-2q67-fp86** advisory does not appear in GitHub's global advisory database, and **CVE-2026-60112** is listed as unreviewed with incomplete details. Neither record is reflected in **PyPI**'s vulnerability data for the package, where the latest published release of `ait-gui` is 2.4.1. ### AI-Assisted Discovery Interestingly, **Yuval Elbar**'s commit for the fix on July 10, 2026, includes a `Co-Authored-By` trailer naming **Anthropic**'s **Claude Opus 4.8** model. **Cycode** commented on this, stating, "This bug was found the way we think most real research will be done from here on: a human researcher working alongside AI-assisted code analysis." Neither advisory names specific missions running the vulnerable software, nor have any exploitation attempts been reported to date. However, the **GitHub Advisory Database** lists other unreviewed records for **NASA** ground software, underscoring the broader security challenges in such critical systems.