Critical Security Vulnerabilities Discovered in NASA AIT-GUI

Security researchers from Cycode have discovered a chain of vulnerabilities in the AIT-GUI, the browser-based operator console for NASA/JPL's AMMOS Instrument Toolkit. These vulnerabilities allow unauthorized attackers to send arbitrary commands to the software system responsible for controlling spacecraft and instruments. The vulnerabilities have been recorded under ID GHSA-p9r8-2q67-fp86 and rated 9.4 on the CVSS v3.1 scoring scale. The AIT-GUI is used in various NASA projects and is part of the open-source initiative aimed at promoting the development of space technologies. The discovery of these security vulnerabilities raises serious concerns regarding the integrity and security of the systems responsible for conducting missions in space.

The vulnerabilities enable attackers to access the AIT-GUI without authentication. This could potentially lead to a takeover of control over spacecraft, which could have catastrophic consequences for ongoing and future missions. Cycode has reported the vulnerabilities to NASA to facilitate a swift resolution. Security research has shown that such vulnerabilities in critical systems not only pose theoretical risks but can also be exploited in practice. NASA has previously taken measures to enhance the security of its systems; however, the discovery of these new vulnerabilities underscores the necessity for continuous monitoring and updates.

The Cycode study highlights that the vulnerabilities in the AIT-GUI are not isolated but part of a larger issue in software security within the field of space technology. Researchers are calling for a comprehensive review and improvement of security protocols to prevent similar incidents in the future. NASA has yet to issue an official statement regarding the discovered vulnerabilities. However, experts warn that time is of the essence to close these security gaps before they can be exploited by malicious actors. The vulnerability could also impact other organizations that utilize similar technologies.

Cycode researchers recommend that organizations relying on the AIT-GUI take immediate action to secure their systems. This includes implementing additional authentication mechanisms and conducting regular security audits. The need to elevate security standards in space technology is becoming increasingly urgent. The discovery of these vulnerabilities occurs in a context where cyberattacks on critical infrastructures are rising globally. NASA and other space organizations must intensify their efforts to address cybersecurity challenges to ensure the safety of their missions. The vulnerability was made public on August 21, 2026.