Home / Technology / NASA's Spacecraft Control Flaw Exposed
NASA's Spacecraft Control Flaw Exposed
21 Aug
Summary
- NASA's ground control software has a critical vulnerability.
- The flaw could allow third-party access to spacecraft control.
- A browser-based variant of NASA's AMMOS Instrument Toolkit is affected.
A critical vulnerability has been identified in NASA's open-source ground control software, posing a risk of unauthorized access and control over spacecraft. The flaw resides within the browser-based interface of the AMMOS Instrument Toolkit (AIT-GUI), specifically in versions up to 2.5.1.
Researcher Yuval Elbar disclosed on August 18, 2026, that the AIT-GUI runs as a web server with open network interfaces and lacks essential security features such as authentication, authorization, and cross-site request forgery (CSRF) protection. This oversight allows attackers to exploit weak access controls.
Exploiting these vulnerabilities enables attackers to issue commands, run scripts, and potentially gain full control over NASA's craft. The risk is amplified as attackers do not need to be on the same network; they can gain access through exposed ports or by directing operators to malicious web pages.
Cycode advises administrators to upgrade AIT-GUI to version 2.5.2 immediately, monitor the console port, and review command history. This incident underscores the high cost of failure for operational software, emphasizing that authentication and input confinement are not optional.
