NASA's Jet Propulsion Laboratory archived the GitHub repository for AIT-GUI, the browser console at the center of its open-source spacecraft ground control toolkit, on October 15, 2026, roughly two months after researchers disclosed a flaw that let an outside party send commands straight to a spacecraft's command bus without logging in.
A Console Built for Teams Without Big Budgets
AIT-GUI is the web interface for the AMMOS Instrument Toolkit, a Python-based ground data system JPL built for instrument, CubeSat, and small satellite teams. A JPL brochure pitches the toolkit at missions that lack the money or staff to build their own commanding and telemetry software from scratch. The GUI layer gives operators a browser-based console for realtime telemetry monitoring and spacecraft commanding, built on the toolkit's core libraries.
No Lock on the Command Bus
Security researcher Yuval Elbar at Cycode found that AIT-GUI's web server accepted a GET request to its root page and handed back a session cookie with no credentials required. That session was enough to authorize a POST to the /cmd endpoint, which passed whatever string arrived straight to the spacecraft command bus. Cycode's writeup, tracked as GHSA-p9r8-2q67-fp86 with a CVSS score of 9.4, found the same missing checks on the /script/run and /seq routes, both of which also built file paths from unvalidated input, letting an attacker reach files outside the designated script and sequence directories. The underlying web server listened on all network interfaces by default, ignoring whatever host setting an operator had configured.
A separate record, CVE-2026-60112, covers the same missing-authentication weakness in the session-creation code and carries a CVSS v3.1 score of 9.8. VulnCheck published it on July 29, 2026, crediting researcher Saidakbarxon Maxsudxonov.
A Patch That Left the Door Ajar
NASA-AMMOS shipped AIT-GUI version 2.5.2 on August 12, 2026, the day before Cycode published its findings. The release bound the web server to the configured host, defaulting to localhost instead of every interface, added checks that reject cross-origin state-changing requests, and confined the script and sequence endpoints to their designated directories. What it did not do, according to a review by The Hacker News, was add authentication to the command, script, or sequence endpoints themselves. Cycode said it did not consider the vulnerability chain fully remediated in that release.
Second Advisory, Then Retirement
A second advisory, GHSA-x8ww-97rj-cx44, followed, and NASA-AMMOS released version 2.5.3 on September 21 and version 2.5.4 the next day, each adding security test coverage tied to that advisory. On October 15, the project's maintainers archived the AIT-GUI repository on GitHub, marking it a read-only public archive and ending active development of the tool. NASA has not issued a public statement on either vulnerability or on the decision to retire the project.
No source has documented a case of an operational mission running a publicly reachable AIT-GUI instance being commanded by an outsider. The toolkit is reference ground software for instrument and small satellite teams rather than flight software running onboard a spacecraft, and the severity ratings reflect what the software could do if exposed rather than confirmed exploitation. Teams still running version 2.5.1 or earlier, or the incompletely patched 2.5.2, are now without a path to further official fixes, since the repository will take no new releases, and are advised to isolate the console's network port rather than wait for an update that will not come.
Cycode first disclosed the vulnerability chain, with additional technical review from The Hacker News.
