Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2026-60112: Unauthenticated Access to AIT-GUI before 2.5.1
CVE-2026-60112 · published 2 months ago
Summary
The AMMOS Instrument Toolkit (AIT) GUI before version 2.5.1 has a security flaw that allows anyone to access it without a password. This could potentially let attackers control spacecraft equipment. To fix this, update to version 2.5.1 or later.
What to do
- Update nasa-ammos ait-gui to version 2.5.1 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| nasa-ammos | ait-gui | < 2.5.1 |
Original advisory text
AMMOS Instrument Toolkit (AIT) GUI before 2.5.1 contains a missing authentication vulnerability that allows any unauthenticated network attacker to obtain a valid session and issue arbitrary spacec...
AMMOS Instrument Toolkit (AIT) GUI before 2.5.1 contains a missing authentication vulnerability that allows any unauthenticated network attacker to obtain a valid session and issue arbitrary spacecraft commands by calling Sessions.create() without any credential check. Attackers can exploit the unauthenticated session issuance in Sessions.create() and subsequently invoke handle_cmd() to forward arbitrary commands directly to the AIT command bus without any authentication gate between session creation and command dispatch.
Severity
9.3
Critical
CVSS 3.1: 9.8 (NVD)
CVSS 4.0: 9.3 (NVD)
Exploitation
EPSS <1%
Type
CWE-306Missing Authentication for Critical Function
Timeline
Published29 Jul 2026
Updated27 Sep 2026
First seen29 Jul 2026
Track software like this
Free during beta