Security researchers at Cycode report AIT-GUI flaws that could let an unauthenticated attacker issue arbitrary commands through NASA/JPL’s AMMOS Instrument Toolkit operator console. The findings focus on AIT-GUI, a web-based interface designed to drive instrument and spacecraft operations, and on the way its HTTP routes handle requests.
The advisory, published on August 13, 2026, assigns the issue a severity of 9.4 using CVSS v3.1. Cycode tracks it under GHSA-p9r8-2q67-fp86 and notes that no CVE was assigned in their disclosure. While Cycode does not describe real-world exploitation, the technical details show multiple ways an attacker who can reach the console could steer command and script execution.
What AIT-GUI is used for
AMMOS Instrument Toolkit (AIT) is a framework for building ground data systems—software that sends commands to instruments and spacecraft and processes telemetry returned from the field. AIT-GUI acts as the operator console that operators use to enter commands in a browser.
From the security report’s perspective, the critical element is the chain between web requests, AIT-GUI’s command handling, and the “command bus” that ultimately delivers operator actions to instruments and spacecraft. If an attacker can invoke those routes without proper access control, they can potentially translate HTTP calls directly into operational behavior.
Unauthenticated access to state-changing endpoints
Cycode states that the AIT-GUI web server binds to a default address and exposes every state-changing route without the typical protections that prevent unauthorized control. In particular, the advisory says:
- The server reads a configured host value, but then discards it.
- By default it binds to 0.0.0.0 on port 8080, meaning it listens on all network interfaces.
- State-changing routes lack authentication and authorization checks.
- Routes also lack CSRF protection.
Cycode emphasizes that the practical “blast radius” is measured in the number of issued instrument commands, not in visual damage such as defacing a web page. In other words, the risk is operational control rather than cosmetic outcomes.
Which AIT-GUI endpoints were implicated
In the advisory, Cycode outlines several actions an unauthenticated party could perform if they can reach the console’s port:
- POST /cmd: issue arbitrary instrument and spacecraft commands.
- POST /script/run: execute server-side scripts, including the ability to reference files outside the intended directory via path traversal.
- POST /seq: run command sequences, including passing files outside the expected directory to a subprocess.
The report classifies the issues under CWEs including CWE-306 (missing authentication for critical function), CWE-352 (cross-site request forgery), and CWE-22 (path traversal). These categories align with the described behavior: anyone who can access the network interface can call dangerous endpoints directly, and browsers can also be tricked into sending those calls cross-origin.
Why cross-origin browser requests mattered
One of the more concerning aspects of the AIT-GUI flaws is how they combine with browser behavior. Cycode explains that the vulnerable routes accept requests with bodies encoded as application/x-www-form-urlencoded. Browsers commonly treat certain form POSTs as “simple” CORS requests, which can bypass the preflight request flow.
As a result, an advisory-controlled cross-origin POST can reach the server without an OPTIONS preflight. Cycode says that traffic captured from a real browser confirmed that zero OPTIONS requests were sent and that the server processed the request anyway.
That means the risk is not limited to attackers who can run scripts on the same origin as the operator console. Even if the deployment is “host-local” or protected by firewalls, an operator who can use the console could still be exposed if they visit a malicious page controlled by the attacker.
Affected versions and the 2.5.2 fix
Cycode says the chain affects AIT-GUI 2.5.1 and earlier and claims the issue is addressed in 2.5.2. The project released 2.5.2 on August 12, 2026.
According to the changelog described in the disclosure, version 2.5.2 adds a “before_request” hook that compares the request’s Origin or Referer header to the server’s configured Host for HTTP methods such as POST, PUT, DELETE, and PATCH. It also confines /script/run and /seq to their configured roots.
Cycode’s report adds nuance: while the update improves protections for cross-origin browser requests by rejecting them via a same-origin check, it does not introduce authentication for the command, script, or sequence endpoints themselves. In other words, the fix reduces the browser-driven CSRF angle, but the console’s access model still depends on network reachability and how sessions are handled.
Session handling concerns still reported in the code review
After reviewing the advisory, a separate examination of tagged source versions found another detail that shapes the overall risk profile. The observation is that in AIT-GUI 2.5.2, the root route still creates a session cookie for incoming requests without a credential check, and the command route accepts requests that carry that cookie.
The same review reportedly confirmed that 2.5.2 restricts where the console listens and blocks browser-driven cross-origin requests, aligning with the intent of the fix. However, it also concluded that the release does not add authentication to endpoints that perform operational actions.
Discrepancies across advisories
The reporting landscape around these AIT-GUI flaws includes overlapping records with inconsistent version guidance. A second record references missing authentication under CVE-2026-60112, rated 9.3 using CVSS v4 and credited to Saidakbarxon Maxsudxonov.
That record appears in vulnerability databases on July 29, 2026, roughly three weeks before Cycode’s August write-up. The earlier record and database entries claim the flaw exists in versions before 2.5.1 and cite a commit described as a patch. Cycode, however, indicates that 2.5.1 is affected and 2.5.2 is fixed.
Further review described in the source material suggests disagreements about the scope of fixes. For example, the code examination reportedly found that the unauthenticated session issuance behavior is present in both 2.5.1 and 2.5.2, and the path-traversal behavior location differs between the records.
What this means for operators and maintainers
Even without evidence of live exploitation, the combination of factors in the AIT-GUI flaws is worth treating seriously: web endpoints that can trigger command bus activity, missing or incomplete access control, default network exposure, and browser behaviors that can enable cross-origin posting.
If you operate systems using AIT-GUI, the most practical takeaway from the disclosed material is to ensure you are on a version that includes the cross-origin request protections and tighter handling of script and sequence paths. In addition, you should assume that network reachability matters: when a server listens on broad interfaces and offers powerful routes, minimizing exposure is essential.
Related issues and broader context
The reporting also notes that other unreviewed GitHub Advisory Database entries exist for NASA ground software, including additional path traversal and server-side file manipulation themes in related components. It also mentions an older unresolved entry in NASA AIT-Core—CVE-2024-35058—described as a critical remote code execution flaw that still shows no patched version status in that database.
While these additional records are separate from the Cycode chain, they underscore a broader lesson: ground data systems and operator tooling often represent high-impact targets, and weaknesses in web-facing control paths can have outcomes beyond typical web app compromise.
Conclusion
The disclosure of AIT-GUI flaws shows how browser-based operational tooling can become a direct control channel when authentication, authorization, CSRF protections, and safe request handling are missing or incomplete. Cycode reports an unauthenticated chain tied to multiple dangerous endpoints, along with version-specific fixes in AIT-GUI 2.5.2 that improve cross-origin browser protections and constrain script and sequence execution roots.
For teams using AMMOS Instrument Toolkit and AIT-GUI, the key action is to update and to reduce exposure of the console to untrusted networks and websites. When the interface can translate HTTP requests into instrument or spacecraft commands, hardening needs to start at the web boundary.
Source: https://thehackernews.com/2026/08/nasa-ait-gui-flaws-could-let.html
