CVE-2026-60112

AIT-GUI < 2.5.1 Missing Authentication via Sessions.create()

Published Jul 29, 2026 CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Description

AMMOS Instrument Toolkit (AIT) GUI before 2.5.1 contains a missing authentication vulnerability that allows any unauthenticated network attacker to obtain a valid session and issue arbitrary spacecraft commands by calling Sessions.create() without any credential check. Attackers can exploit the unauthenticated session issuance in Sessions.create() and subsequently invoke handle_cmd() to forward arbitrary commands directly to the AIT command bus without any authentication gate between session creation and command dispatch.

Analysis

Technical impact

The AMMOS Instrument Toolkit GUI prior to version 2.5.1 contains a missing authentication check in Sessions.create(). Any network attacker can request a session without providing credentials, after which the attacker may invoke handle_cmd() to dispatch arbitrary commands directly to the AIT command bus. This flaw constitutes a full authentication bypass (CWE‑306) and enables complete control over spacecraft operations without authorization.

Affected Systems

The vulnerability affects all releases of NASA‑AMMOS AIT‑GUI earlier than version 2.5.1; any deployment of those versions that exposes Sessions.create() via the network is susceptible.

Risk and Exploitability

With a CVSS score of 9.3 the issue is rated critical. The EPSS score is below 1%, indicating a low but non‑zero likelihood of exploitation. It is not listed in the CISA KEV catalog. The attack vector is remote network; an attacker only needs network reachability to the GUI service to obtain a session and issue commands, with no prerequisite authentication.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

NASA-AMMOS

AIT-GUI

affected

Version	Status	Constraints
`0`	affected	< 2.5.1

Configuration 1 [-]

cpe:2.3:a:nasa:ait_gui:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Nasa-ammos

Ait-gui

Version	Status	Scheme	Platform
`[0,2.5.1)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade AIT‑GUI to version 2.5.1 or later, which enforces authentication on session creation.
Apply any vendor‑supplied patches if the latest release is not yet available.
Isolate the AIT GUI endpoint from external networks or implement firewall rules blocking unauthorized traffic until the patch is deployed.

Generated by OpenCVE AI on August 3, 2026 at 13:14 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.788% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://github.com/NASA-AMMOS/AIT-GUI/blob/2.5.1/CHANGELOG.md
https://github.com/NASA-AMMOS/AIT-GUI/commit/beb8fc0813eded89f985d3eb9a73535dd327726d
https://github.com/NASA-AMMOS/AIT-GUI/releases/tag/2.5.1
https://www.vulncheck.com/advisories/ait-gui-missing-authentication-via-sessions-create

History

Aug 18, 2026 2:15 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Nasa Nasa ait Gui
CPEs		cpe:2.3:a:nasa:ait_gui::::::::
Vendors & Products		Nasa Nasa ait Gui

Jul 30, 2026 2:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Nasa-ammos Nasa-ammos ait-gui
Vendors & Products		Nasa-ammos Nasa-ammos ait-gui

Jul 29, 2026 6:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jul 29, 2026 4:15 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		AMMOS Instrument Toolkit (AIT) GUI before 2.5.1 contains a missing authentication vulnerability that allows any unauthenticated network attacker to obtain a valid session and issue arbitrary spacecraft commands by calling Sessions.create() without any credential check. Attackers can exploit the unauthenticated session issuance in Sessions.create() and subsequently invoke handle_cmd() to forward arbitrary commands directly to the AIT command bus without any authentication gate between session creation and command dispatch.
Title		AIT-GUI < 2.5.1 Missing Authentication via Sessions.create()
Weaknesses		CWE-306
References		https://github.com/NASA-AMMOS/AIT-GUI/blob/2.5.1/CHANGELOG.md https://github.com/NASA-AMMOS/AIT-GUI/commit/beb8fc0813eded89f985d3eb9a73535dd327726d https://github.com/NASA-AMMOS/AIT-GUI/releases/tag/2.5.1 https://www.vulncheck.com/advisories/ait-gui-missing-authentication-via-sessions-create
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}` cvssV4_0 `{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`