Editor’s note: This article was updated on August 21, 2026, to include a statement from NASA.
A vulnerability in the open-source ground-control software developed by NASA’s Jet Propulsion Laboratory (JPL) has been found to allow unauthenticated attackers to send commands to connected spacecraft or scientific instruments in an exposed deployment.
The flaw was first disclosed by security researcher Yuval Elbar in a report published by Cycode.
The vulnerability, tracked as GHSA-p9r8-2q67-fp86, received a CVSS score of 9.4, though no CVE has been assigned yet.
It affects AIT-GUI, the browser-based interface for NASA/JPL’s open-source AMMOS Instrument Toolkit, through version 2.5.1. AIT is a Python-based software suite used by space mission engineers to build ground data systems, prepare, execute and send commands to spacecraft, and process incoming telemetry data.
Elbar found that state-changing AIT-GUI endpoints lacked authentication, authorization and cross-site request forgery protection. An attacker who can connect to a server running the vulnerable software could thus submit requests without valid credentials.
In addition, a malicious website opened by an operator could cause their browser to send unauthorized requests to AIT-GUI, even if the interface is hosted locally or protected by a firewall.
Three Endpoints, No Credentials Needed
Elbar showed that one endpoint, POST /cmd, could be used to send arbitrary commands. Two others, POST /script/run and POST /seq, would allow attackers to run server-side scripts and execute command sequences, respectively.
The researcher also identified path-traversal weaknesses in the latter two that could cause the software to resolve file paths outside the intended script and sequence directories.
The risks associated with the flaw are greater when considering that AIT-GUI’s web server accepts connections via all the host computer’s network interfaces, as it is bound to 0.0.0.0, even if an operator selected more restrictive settings.
The interface could thus be reached from other devices on the network and, depending on firewall and routing configurations, from the internet through the default port 8080.
The vulnerability was fixed in AIT-GUI version 2.5.2. Cycode advised users to upgrade to the corrected release, ensure that the software is not reachable from untrusted networks, and treat any prior exposure as reason to review command and sequence history.
So far, no real-world exploitation, compromised spacecraft or affected missions have been publicly reported. Following publication, NASA provided Expert Insights with a statement confirming that JPL engineers had resolved the vulnerability and pointing users to its advisory and disclosure process.
“NASA is committed to the cybersecurity and the protection of our systems. We work closely with our federal partners, including the Cybersecurity and Infrastructure Security Agency (CISA), to quickly address identified vulnerabilities. Engineers at NASA’s Jet Propulsion Laboratory confirmed and resolved a vulnerability in the open-source Advanced Multi-Mission Operations System (AMMOS) Instrument Toolkit Graphical User Interface (AIT-GUI) web API. We maintain ongoing collaboration with software developers and partners, while proactively monitoring and evaluating our networks, software, and data to identify and address potential risks.”
“For security reasons, NASA generally does not comment on specific reports of potential vulnerabilities. However, NASA has fully addressed this issue in version 2.5.2, and the team published a detailed security advisory on GitHub to alert the user community. Users of AIT-GUI are encouraged to upgrade to the latest version and follow National Institute of Standards and Technologies cybersecurity best practices.”
“NASA recognizes that external vulnerabilities can be discovered by anyone at any time and has issued the Vulnerability Disclosure Policy to provide clear guidelines to security researchers to report potential vulnerabilities. Bugcrowd is the official channel to report vulnerabilities for NASA systems. Submit reports via: https://bugcrowd.com/engagements/nasa-vdp. For additional information regarding federal systems, please contact CISA.”
