CVE-2026-60112: AMMOS Instrument Toolkit Auth Bypass Flaw

CVE-2026-60112 Overview

CVE-2026-60112 is a missing authentication vulnerability [CWE-306] in the AMMOS Instrument Toolkit (AIT) GUI before version 2.5.1. The flaw resides in the Sessions.create() endpoint, which issues valid sessions to any network caller without performing a credential check. An unauthenticated attacker can obtain a session and then call handle_cmd() to forward arbitrary commands directly to the AIT command bus. Because AIT-GUI is used for spacecraft instrument command and telemetry operations, exploitation permits arbitrary spacecraft command dispatch from an unauthenticated remote position.

Critical Impact
Unauthenticated network attackers can issue arbitrary spacecraft commands through the AIT command bus with no authentication gate between session creation and command dispatch.

Affected Products

NASA-AMMOS AIT-GUI versions prior to 2.5.1
Deployments exposing the AIT-GUI web interface to reachable networks
Any downstream mission systems relying on AIT-GUI for command dispatch to spacecraft instruments

Discovery Timeline

2026-07-29 - CVE-2026-60112 published to NVD
2026-07-29 - Last updated in NVD database

Technical Details for CVE-2026-60112

Vulnerability Analysis

AIT-GUI exposes a session management endpoint that maps to Sessions.create(). The function instantiates and returns a valid session object without validating any credential, token, or origin restriction. Once a session exists, the server treats subsequent requests as authorized. The handle_cmd() handler consumes session-scoped requests and forwards command payloads directly onto the AIT command bus, which relays them to connected spacecraft instruments or simulators. No secondary authentication check gates command dispatch, so an attacker that reaches Sessions.create() reaches the command bus.

The underlying weakness is a missing authentication for a critical function [CWE-306]. The command bus in AIT is intended as a trusted internal channel; exposing an unauthenticated path to it removes the trust boundary that operators rely on. This is not a bypass of an existing control — the control was absent.

Root Cause

The Sessions.create() handler in ait/gui/__init__.py accepts anonymous callers and returns a working session. Session issuance was designed as an internal bootstrap step, but the endpoint is reachable over the same HTTP interface exposed to the network. Without a credential check at session creation or a re-authentication check at handle_cmd(), session possession alone grants full command authority.

Attack Vector

Exploitation requires only network reachability to the AIT-GUI HTTP interface. The attacker calls Sessions.create() to obtain a session, then submits command payloads to handle_cmd(). The command bus forwards them without further validation. No user interaction, privileges, or prior foothold is required.

python

# Patch reference from ait/gui/__init__.py
 import os
 import struct
 import sys
+import tempfile
 import time
 from typing import Dict
 import urllib

Source: GitHub AIT-GUI Commit

The patch in version 2.5.1 restricts script execution paths and replaces static temporary files with tempfile-managed resources as part of a broader hardening of the GUI, alongside authentication enforcement on session issuance. See the GitHub AIT-GUI Changelog for the full change list.

Detection Methods for CVE-2026-60112

Indicators of Compromise

Unauthenticated HTTP POST requests to the Sessions.create() endpoint from external or unexpected source addresses.
Sequences of Sessions.create() followed by rapid calls to handle_cmd() from the same client without prior operator login events.
Command bus traffic containing operator commands that lack a corresponding authenticated GUI session in application logs.
Anomalous command dispatch outside of documented mission operations windows.

Detection Strategies

Correlate AIT-GUI web access logs with command bus dispatch records to flag commands with no authenticated session origin.
Alert on any request to Sessions.create() that does not include expected authentication headers or precedes a valid operator authentication event.
Baseline expected client IP ranges for the AIT-GUI interface and alert on any session creation from outside that range.

Monitoring Recommendations

Enable verbose request logging on the AIT-GUI process and forward logs to a central SIEM for retention and correlation.
Monitor for outbound command bus activity that lacks an associated session identifier in the audit trail.
Track version strings of running AIT-GUI instances and alert when any host reports a version below 2.5.1.

How to Mitigate CVE-2026-60112

Immediate Actions Required

Upgrade AIT-GUI to version 2.5.1 or later on every host running the interface, following the GitHub AIT-GUI Release 2.5.1 notes.
Remove AIT-GUI from any network segment reachable by untrusted hosts until the patch is deployed.
Rotate operator credentials and audit command bus history for any commands issued outside of authorized operations.
Review the VulnCheck AIT-GUI Advisory for advisory-level guidance.

Patch Information

The fix is included in AIT-GUI 2.5.1. The change adds authentication enforcement around session issuance and hardens auxiliary script execution paths. Refer to the GitHub AIT-GUI Commit for the applied source changes and to the GitHub AIT-GUI Changelog for the full release notes.

Workarounds

Place the AIT-GUI HTTP interface behind an authenticating reverse proxy that requires operator credentials before proxying requests to Sessions.create() or handle_cmd().
Restrict network access to the AIT-GUI listener using host firewall rules that allow only known operator workstations.
Bind the AIT-GUI service to a loopback or management-only interface until the upgrade to 2.5.1 is complete.

bash

# Restrict AIT-GUI listener to trusted operator subnet only
iptables -A INPUT -p tcp --dport 8080 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP