A 9.4 That Lets Anyone on the Network Command a Spacecraft. NASA Shipped the Fix. Nobody Assigned It a Number — So Your Scanner Will Never See It, and Neither Did Ours.
- Patrick Duggan
- 2 hours ago
- 6 min read
There is a vulnerability chain in NASA/JPL software that lets an unauthenticated attacker on the network issue arbitrary commands to a spacecraft and instrument command bus. It is rated CVSS 9.4. It was disclosed on 18 August 2026. The fix shipped. The advisory is public.
It has no CVE.
Not "a CVE pending." Not "a CVE we are waiting on." The advisory says it plainly: no CVE has been assigned at the time of writing. Which means that for every defender whose vulnerability management runs on identifiers — and that is effectively all of them — this 9.4 does not exist.
We know, because it did not exist for us either. More on that below, because it is the least comfortable part of this post and the part we would rather you took away.
What the software is
AIT-GUI is the browser-based operator console for the AMMOS Instrument Toolkit, JPL's open-source framework for building ground-segment software — the stuff that talks to instruments and spacecraft. It is not obscure shelfware. It is the free, open, reusable toolkit that small missions, university payloads, cubesat teams and instrument builders reach for precisely because they do not have a Lockheed budget for a bespoke ground system.
That is exactly the population we care about here. A flagship mission has a security team. A university instrument team running AIT because it was free and it worked does not, and they are the ones who inherit this.
The chain, in four moves
Cycode's researchers found four weaknesses that compose into one unauthenticated command-execution path. Read them in order, because each one on its own would be a finding and together they are a door with no building around it.
One — reachability. The server reads the configured host into a variable and then never uses it. The listener is hardcoded to bind [0.0.0.0](https://analytics.dugganusa.com/stix/register?ref=ioc-click&q=0.0.0.0). Every operator who set the host to localhost, believing they had confined the console to the machine, was in fact serving it to the entire reachable network. The configuration option exists, is documented, is honoured by nobody.
Two — identity. No authentication. No authorization. No CSRF protection on any state-changing endpoint.
Three — the command relay. A POST endpoint takes arbitrary commands and relays them onto the spacecraft and instrument command bus without validation.
Four — the filesystem. Path traversal in the script and sequence endpoints, because user input is joined straight onto filesystem roots.
Affected: AIT-GUI 2.5.1 and earlier. Fixed in 2.5.2. If you run AIT-GUI, that upgrade is tonight's job, and the interim control is a network one — put it behind something, because the software's own host binding will not do it for you.
The part that should worry you more than the bug
The bug gets fixed. Version 2.5.2 exists. That is the system working.
What did not work is the labelling, and the labelling is what turns a fix into a fixed fleet.
A CVE identifier is not paperwork. It is the join key. It is the single string that lets NVD carry the record, lets every vulnerability scanner on earth match your installed version against a known-bad range, lets CISA consider it for the Known Exploited Vulnerabilities catalogue, lets your SBOM tooling raise a hand, and lets an automated feed like ours index it and hand it to you.
Strip the identifier and every one of those mechanisms goes quiet at once. Not wrong — quiet. Your scanner reports clean. Your SBOM check passes. Your patch policy, which says "remediate critical CVEs within N days," is fully satisfied, because there is no critical CVE. The 9.4 sits there with a green dashboard on top of it.
This is the shape we have been naming all month: the control held, the handoff was unassigned. Cycode did their half — found it, wrote it up, disclosed it responsibly. JPL did their half — shipped 2.5.2. GitHub published the advisory. Every named party discharged its duty. The half that nobody owns is issuing the number that makes all the other halves machine-readable, and there is no name in the process for whoever was supposed to do that.
We were blind to it too, and here is the receipt
We ran our own corpus against this before writing a word, because we have a standing rule that we research our own data before we call anything a gap.
Our iocs index, queried on 24 August 2026: two hits for "ait-gui", both irrelevant. One is a phishing URL that happens to contain the letters. The other is a hosting domain flagged by ThreatFox for ClickFix payload delivery — a substring collision, nothing to do with NASA. Attributed records for this advisory: zero.
Why? Because our exploit harvester keys on CVE identifiers. It sweeps GitHub for proof-of-concept code, correlates on the CVE, extracts endpoints, and writes detection rules. It is a good machine and it has given us real leads — sixteen days on the Oracle proxy bug last week, three days on GitLab this week. And it is structurally incapable of seeing a vulnerability that was never given a number, because the number is the thing it hunts on.
So when we say the missing identifier costs defenders visibility, we are not scoring a point off somebody else's process. We are describing a hole in our own instrument that this advisory just walked through. That is what an honest gap report looks like. The alternative — writing this post as though we had it covered — is the thing we correct ourselves for publicly when we slip into it.
What this is a case of
We keep a standing beat on label failure: fixes that ship with no CVE, no security advisory, or a quiet "bug fix" changelog entry that happens to close a remote code execution. The failure of the label is a distinct failure from the failure of the code, it is far more common than the industry admits, and it is invisible by construction — you cannot count what was never named.
This is the most vivid instance we have logged. Not because a spacecraft is more important than a hospital — it is not — but because the gap between "CVSS 9.4, unauthenticated, commands a spacecraft bus" and "will not appear in any scan report on earth" is as wide as that gap gets.
If you take one operational thing from this: your CVE-driven pipeline is a floor, not a ceiling. Watch the GitHub Security Advisory feed for the ecosystems you actually deploy, watch your vendors' release notes for the fixes that arrive without an advisory, and treat "no findings" as a statement about your scanner's inputs rather than about your estate.
Sources
Vulnerability chain in AIT-GUI ≤ 2.5.1, fixed in 2.5.2, rated CVSS v3.1 9.4, disclosed by Cycode as GHSA-p9r8-2q67-fp86, published 18 August 2026 and reported on 19–20 August. AIT-GUI is the web front end for NASA/JPL's open-source AMMOS Instrument Toolkit. Reporting on the disclosure also references CVE-2026-60112, a separate missing-authentication issue published 28 July 2026 in the same product family — we have not independently verified the relationship between the two, so we are not asserting one.
Our own coverage claim — zero attributed records — is from our iocs index, queried 24 August 2026.
Capped where we always cap it, at 95 percent: we have no telemetry on how many AIT-GUI instances are actually exposed, we have not scanned for them and we are not going to, and it is entirely possible a CVE has been assigned between the advisory and this post going live. If one has, that is good news and we will say so.
If you run AMMOS or AIT anywhere in your ground segment, upgrade to 2.5.2 tonight and then go and check what the listener is actually bound to rather than what your config file says. And if you know who was supposed to assign the number here, tell me — the process gap is the more interesting story and I do not yet understand it. Rate this post below.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=a-9-4-that-lets-anyone-on-the-network-command-a-spacecraft-nasa-shipped-the-fix-nobody-assigned-it
Comments