NASA AIT-GUI Flaws Could Let Unauthenticated Attackers Issue Spacecraft Commands
- ID
- 15984
- Status
- summarized
- Published
- 20 Aug 2026, 7:05 PM
- Fetched
- 20 Aug 2026, 7:26 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/08/nasa-ait-gui-flaws-could-let.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 2.0
- Created
- 20 Aug 2026, 7:29 PM
- Tags
- Audience
- developers
What happened
Cycode researchers disclosed a 9.4 CVSS vulnerability chain in AIT-GUI (versions ≤2.5.1), the browser-based operator console for NASA/JPL's open-source AMMOS Instrument Toolkit. The server binds to 0.0.0.0:8080 by default, discards its configured host, and exposes state-changing routes with no auth, no CSRF protection, and path traversal—letting any unauthenticated party issue spacecraft commands, run server-side scripts, or execute command sequences. Fixed in version 2.5.2.
Why it matters
Almost nobody in this audience runs AIT-GUI or builds ground data systems for spacecraft. The only transferable lesson is the anti-pattern: a web server that ignores its own bind config, listens on all interfaces, and exposes state-changing POST routes with no auth or CSRF checks—a pattern worth checking for in your own internal tooling.
Discussion angle
The design failure is more instructive than the CVE itself: a tool that drives spacecraft shipped with 0.0.0.0 binding, no auth, and CORS-simple POST routes—use it as a case study for what to audit in your own internal operator consoles.