NASA's ground control software has a worrying security flaw which could let hackers contact spacecraft

NASA's ground control software contains a critical security flaw that could enable hackers to gain access and take control of spacecraft. The vulnerability, discovered in a browser-based version of NASA's AMMOS Instrument Toolkit (AIT), arises from the AMMOS Instrument Toolkit Graphical User Interface (AIT-GUI) tool. Versions of AIT-GUI up to 2.5.1 are susceptible, but the issue has been corrected in version 2.5.2, according to researcher Yuval Elbar.

The flaw allows an unauthenticated attacker to gain access and control of the spacecraft, execute server-side scripts, and run command sequences. The API lacks authentication and authorization protection, and the CSRF protection for changing endpoints is absent in the affected versions of AIT-GUI. This means attackers could exploit the access-control security failings, leading to potential malware or custom-built script execution on NASA spacecraft.

Elbar revealed the vulnerability on August 18, 2026, highlighting that the web GUI for AIT-GUI runs on every network interface and requires no password. It can be manipulated by any web page opened by an operator. Furthermore, the external access to the vulnerable AIT-GUI browser session means that attackers don't even need to be on the same network as the spacecraft. They could direct an operator to a web page hiding malicious code or simply control a web page under their own control to gain access.

Cycode recommends NASA administrators to upgrade AIT-GUI to version 2.5.2, run checks on the console port, and review command history to address the security flaw.