Back Ciberseguridadlatam

Falla crítica en software de NASA/JPL permite comandar naves espaciales sin autenticación

Ciberseguridadlatam •Redacción CSL • August 23, 2026

AIT-GUI, la consola web de código abierto que opera instrumentos en misiones espaciales, exponía endpoints de comando sin ninguna barrera de seguridad. Investigadores de Cycode descubrieron que AIT-GUI, la interfaz web del AMMOS Instrument Toolkit de NASA/JPL, inicia un servidor HTTP sin autenticación, autorización ni protección CSRF en ninguno de sus endpoints que cambian estado. […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical NASA/JPL Software Flaw Allows Unauthorized Spacecraft Command A critical vulnerability in NASA/JPL's AIT-GUI software was discovered, allowing unauthorized command of spacecraft. The open-source web console, which operates instruments for space missions, exposes command endpoints without any security measures, including authentication or CSRF protection. This flaw was identified by researchers from Cycode, who noted that the HTTP server starts without any form of access control. The potential impact could be severe, as it may allow malicious actors to manipulate spacecraft operations. No specific CVEs were mentioned in the articles, but the vulnerability raises significant concerns about the security of space mission operations. As of now, there are no reports of exploitation, but the lack of security measures poses a high risk. Immediate action is recommended to secure the affected systems. 2 sources 67

Extracted Entities

Companies (1)

NASA

CWE Weaknesses (3)

CWE-287 - Improper Authentication Cwe-352 - Cross-Site Request Forgery (csrf)CWE-862 - Missing Authorization