Critical NASA AIT-GUI Flaw Lets Unauthenticated Attackers Issue Spacecraft Commands
Brief
A critical security flaw in NASA/JPL’s open-source AMMOS Instrument Toolkit GUI (AIT-GUI) could let an unauthenticated attacker send live commands to spacecraft and scientific instruments, run arbitrary scripts, and execute command sequences without ever logging in.
Security researcher Yuval Elbar of Cycode disclosed an issue rated 9. 4 on the CVSS v3. 1 scale on August 13, 2026. This issue has been patched in AIT-GUI version 2.
- 2, which was released on August 12, 2026.
AIT-GUI is the browser-based operator console for the AMMOS Instrument Toolkit , a widely used open-source framework for building ground data systems that send commands to spacecraft and instruments and process the telemetry that comes back.