CVE-2026-60112: AIT-GUI < 2.5.1 Missing Authentication via Sessions.create()
AMMOS Instrument Toolkit (AIT) GUI before 2.5.1 contains a missing authentication vulnerability that allows any unauthenticated network attacker to obtain a valid session and issue arbitrary spacecraft commands by calling Sessions.create() without any credential check. Attackers can exploit the unauthenticated session issuance in Sessions.create() and subsequently invoke handlecmd() to forward arbitrary commands directly to the AIT command bus without any authentication gate between session creation and command dispatch.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AMMOS Instrument Toolkit (AIT) GUIto a version that resolves this vulnerability.Fixed in 2.5.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-60112?
The severity of CVE-2026-60112 is critical with a score of 9.8.
How do I fix CVE-2026-60112?
To fix CVE-2026-60112, upgrade to AIT-GUI version 2.5.1 or later.
What type of vulnerability is CVE-2026-60112?
CVE-2026-60112 is a missing authentication vulnerability.
Who is affected by CVE-2026-60112?
Users of AIT-GUI versions prior to 2.5.1 are affected by CVE-2026-60112.
What are the potential impacts of CVE-2026-60112?
CVE-2026-60112 can allow an unauthenticated attacker to issue arbitrary spacecraft commands.