Read the docs
TI-2026-42832 Aliases CVE-2026-60112GHSA-3j6g-pxmx-58qg

AIT-GUI < 2.5.1 Missing Authentication via Sessions.create()

Priority MEDIUM 49CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

AMMOS Instrument Toolkit (AIT) GUI before 2.5.1 contains a missing authentication vulnerability that allows any unauthenticated network attacker to obtain a valid session and issue arbitrary spacecraft commands by calling Sessions.create() without any credential check. Attackers can exploit the unauthenticated session issuance in Sessions.create() and subsequently invoke handle_cmd() to forward arbitrary commands directly to the AIT command bus without any authentication gate between session creation and command dispatch.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00788 56th percentileScored 2026-11-07
Fix Fixed AIT-GUI (NASA-AMMOS): 2.5.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NASA-AMMOSAIT-GUIbefore 2.5.12.5.1Patch availableCNA
  • AIT-GUI VendorNASA-AMMOS Affected before 2.5.1 Fixed in 2.5.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:nasa:ait_gui:*:*:*:*:*:*:*:*before 2.5.1Vulnerablenasa
  • cpe:2.3:a:nasa:ait_gui:*:*:*:*:*:*:*:* Versions before 2.5.1 Vulnerable ·nasa

Remediation

  • Fix · CNA AIT-GUI (NASA-AMMOS) Fixed in 2.5.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-60112
  2. 2026-10-03 Alias added: GHSA-3j6g-pxmx-58qg

References

Patch 1

Other 2

  • TI-2026-35232 Path traversal in NASA-AMMOS AIT-Core CVSS 3.1CRITICAL 9.1
  • TI-2026-67483 Missing authentication in NASA-AMMOS AIT-Core CVSS 3.1CRITICAL 9.8
  • TI-2026-49956 NASA-AMMOS ANMS / JHUAPL dtnma-tools Unauthenticated Remote Command Execution via Exposed AMP Manager REST API CVSS 3.1CRITICAL 9.8
  • TI-2026-49889 NASA-AMMOS plandev - Client-Supplied session_variables Bypass Hasura-Origin Authorization in sequencing-server CVSS 3.1CRITICAL 9.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences