CVE-2026-60113 Overview
CVE-2026-60113 is a missing authentication vulnerability [CWE-306] in the NASA AMMOS Instrument Toolkit (AIT) Deep Space Network (DSN) Interface before version 2.2.2. The flaw resides in the Space Link Extension (SLE) interface manager, which exposes seven API routes without any authentication controls. Unauthenticated network attackers can send direct HTTP requests to these endpoints and control spacecraft communication sessions. Attackers can start or stop DSN sessions, retrieve telemetry frame data, and inject arbitrary frames into active spacecraft links.
Critical Impact
Unauthenticated attackers with network access to the SLE interface manager can hijack Deep Space Network sessions and inject arbitrary frames into live spacecraft communication links.
Affected Products
- NASA AMMOS Instrument Toolkit (AIT) Deep Space Network (DSN) Interface versions prior to 2.2.2
- Space Link Extension (SLE) interface manager component
- Deployments exposing AIT-DSN API routes on reachable networks
Discovery Timeline
- 2026-07-13 - Fix released in AIT-DSN 2.2.2 (per project CHANGELOG)
- 2026-07-29 - CVE-2026-60113 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-60113
Vulnerability Analysis
The AIT-DSN project provides Python-based interfaces for communicating with the NASA Deep Space Network through the Space Link Extension (SLE) protocol suite. The sle_interface_manager module exposes a Bottle-based HTTP API used to control SLE service instances such as Return All Frames (RAF), Return Channel Frames (RCF), and Forward CLTU services.
Seven API routes in this manager accept requests without verifying caller identity or authorization. Any host that can reach the manager over the network can invoke session lifecycle operations, read returned telemetry frames, and push Communication Link Transmission Units (CLTUs) into an active forward link.
The consequences extend beyond information disclosure. Injecting arbitrary CLTU frames into a live spacecraft link can influence commanding traffic. Stopping an active session interrupts mission telemetry and command flow.
Root Cause
The root cause is the absence of any authentication or authorization check on the SLE interface manager's HTTP routes [CWE-306]. Route handlers act on request parameters directly and dispatch operations against ServiceState and ServiceType objects without confirming the requester is authorized to control the session.
Attack Vector
Exploitation requires only network reachability to the SLE interface manager's listening port. An attacker sends direct HTTP requests to endpoints such as those handling CLTU upload, session start, session stop, and frame retrieval. No credentials, tokens, or user interaction are required.
if srvc_info.state != ServiceState.STARTED:
ait.core.log.error(f"{interface} instance is not started. Unable to upload.")
bottle.response.status = 400
+ else:
+ if srvc_info.type == ServiceType.CLTU:
+ proceed = True
+ data_len = len(srvc_info.data)
- if srvc_info.type == ServiceType.CLTU:
- proceed = True
- data_len = len(srvc_info.data)
-
- if self.verbose:
- if data_len == 0:
- ait.core.log.info("No CLTU data to push.")
- else:
- ait.core.log.info(f"Pushing {data_len} chunks of CLTU data")
+ if self.verbose:
+ if data_len == 0:
+ ait.core.log.info("No CLTU data to push.")
+ else:
+ ait.core.log.info(f"Pushing {data_len} chunks of CLTU data")
- while srvc_info.data and proceed:
- data_to_push = srvc_info.data[0]
- try:
- self.cltu_service.service.upload_cltu(data_to_push)
- del srvc_info.data[0]
- if self.verbose:
- ait.core.log.info(f"tc_data sent: {data_to_push}")
Source: GitHub Commit 06d07d1 — patch in ait/dsn/sle/util/sle_interface_manager.py that tightens the CLTU upload path as part of adding authentication to the SLE API routes.
Detection Methods for CVE-2026-60113
Indicators of Compromise
- Unexpected HTTP requests to the SLE interface manager from hosts outside the mission operations network
- Session start or stop events on RAF, RCF, or CLTU services that do not correlate with authorized operator activity
- CLTU upload operations logged with unusual tc_data sent entries or unfamiliar data volumes
- Telemetry frame retrieval requests originating from addresses not associated with ground data system consumers
Detection Strategies
- Enable verbose logging in the SLE interface manager and forward ait.core.log output to a central log store for review
- Correlate SLE API access logs with authorized operator sessions to surface anonymous or unattributed calls
- Alert on any HTTP 200 responses to SLE control routes when the source IP is outside an approved allowlist
- Baseline normal frame retrieval and CLTU upload cadence, then flag deviations
Monitoring Recommendations
- Capture full request URIs, source addresses, and response codes for every SLE manager endpoint
- Monitor for spikes in upload_cltu invocations or repeated session start/stop cycles indicative of tampering
- Integrate AIT-DSN logs with a SIEM or data lake to enable long-window correlation across mission systems
- Review network flow data for connections to the SLE manager port from unexpected segments
How to Mitigate CVE-2026-60113
Immediate Actions Required
- Upgrade AIT-DSN to version 2.2.2 or later, which introduces authentication on the affected SLE API routes
- Restrict network reachability of the SLE interface manager to trusted mission operations hosts only
- Audit recent SLE manager logs for unauthorized session control or CLTU upload activity
- Rotate any shared secrets or operator credentials used in adjacent ground systems if compromise is suspected
Patch Information
The fix ships in AIT-DSN release 2.2.2, tagged on 2026-07-13. See the GitHub Release Tag 2.2.2, the CHANGELOG entry for 2.2.2, the fixing commit 06d07d1, the GitHub Security Advisory GHSA-gj83-67wr-82mv, and the VulnCheck advisory for full details.
Workarounds
- Place the SLE interface manager behind a reverse proxy that enforces authentication and TLS termination
- Bind the manager to loopback or a management VLAN and require operators to reach it through a bastion host
- Apply host firewall rules that permit only known ground data system IP addresses to the manager port
- Disable the SLE interface manager service when it is not actively required for mission operations
# Example firewall restriction to permit only trusted ground system hosts
iptables -A INPUT -p tcp --dport 8080 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP
# Verify the installed AIT-DSN version meets the fixed release
pip show ait-dsn | grep -i version
# Expected: Version: 2.2.2 (or later)
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
