CVE-2026-60112

CriticalCVSS 9.8/10Last modified Oct 23, 2026

Description

AMMOS Instrument Toolkit (AIT) GUI before 2.5.1 contains a missing authentication vulnerability that allows any unauthenticated network attacker to obtain a valid session and issue arbitrary spacecraft commands by calling Sessions.create() without any credential check. Attackers can exploit the unauthenticated session issuance in Sessions.create() and subsequently invoke handle_cmd() to forward arbitrary commands directly to the AIT command bus without any authentication gate between session creation and command dispatch.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-306

Affected software

Vendor	Product	Versions
NASA-AMMOS	AIT-GUI	< 2.5.1

References

https://github.com/NASA-AMMOS/AIT-GUI/blob/2.5.1/CHANGELOG.mdRelease Notes
https://github.com/NASA-AMMOS/AIT-GUI/commit/beb8fc0813eded89f985d3eb9a73535dd327726dPatch
https://github.com/NASA-AMMOS/AIT-GUI/releases/tag/2.5.1Product, Release Notes
https://www.vulncheck.com/advisories/ait-gui-missing-authentication-via-sessions-createPatch, Release Notes, Third Party Advisory

Timeline

Published: Jul 29, 2026
Last modified: Oct 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-601139.8AMMOS Instrument Toolkit (AIT) Deep Space Network (DSN) Interface before 2.2.2 contains a missing authentication vulnerability in the Space CVE-2026-601147.5Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a path traversal vulnerability that allows attackers with access to th CVE-2026-601176.2The Android implementation of the Flutter/Dart receive_sharing_intent package, versions 1.4.1 through 1.9.0, contains a path traversal vulne CVE-2026-601185.3Hi.Events before 1.11.0 contains a missing server-side visibility enforcement vulnerability that allows unauthenticated attackers to purchas CVE-2026-601195.4Hi.Events before 1.11.0 contains a cross-site scripting vulnerability that allows authenticated attackers with event creation or edit permis CVE-2026-60128.8A security vulnerability has been detected in D-Link DIR-513 1.10. This affects the function formSetPassword of the file /goform/formSetPass CVE-2026-601205.4Bagisto before 2.4.4 contains a stored cross-site scripting vulnerability via client-side template injection that allows unauthenticated att CVE-2026-601219.8Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in the admin/ajax/ping.php endpoint that allows remote CVE-2026-601227.8gpsd through release-3.27.5, fixed at commit 4c06658, contains a code injection vulnerability in the gpsprof utility that allows an attacker CVE-2026-601245.3An authorization bypass in MISP’s EventsController::importModule() allowed authenticated users or read-only API keys with event view access CVE-2026-601255.3MISP’s importModule() path used getEnabledModule() to resolve a single import module by name, but this lookup did not enforce the per-organi CVE-2026-60138.8A vulnerability was detected in D-Link DIR-513 1.10. This vulnerability affects the function formSetRoute of the file /goform/formSetRoute o