CVE-2026-60112 NASA-AMMOS CVE debrief

Who should care

Organizations using AIT GUI versions prior to 2.5.1 should be aware of this vulnerability and take necessary actions to mitigate it. Affected operators, platforms, and security teams should review system configurations, implement additional authentication mechanisms, and monitor for potential exploitation.

Technical summary

The AIT GUI before version 2.5.1 contains a missing authentication vulnerability. This allows any unauthenticated network attacker to obtain a valid session by calling Sessions.create() without any credential check. Subsequently, attackers can invoke handle_cmd() to forward arbitrary commands directly to the AIT command bus without any authentication gate between session creation and command dispatch. The vulnerability affects AIT GUI versions prior to 2.5.1 and can be mitigated by applying the patch or updating to version 2.5.1 or later.

Defensive priority

High

Recommended defensive actions

• Apply the patch from https://github.com/NASA-AMMOS/AIT-GUI/commit/beb8fc0813eded89f985d3eb9a73535dd327726d
• Update to AIT GUI version 2.5.1 or later
• Review system configurations for potential vulnerabilities
• Implement additional authentication mechanisms
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE-2026-60112 record and NVD detail provide information on the vulnerability. The AIT GUI version 2.5.1 changelog, patch commit, and release notes offer mitigation details. Evidence is limited to public sources and may not reflect the full scope or impact of the vulnerability. Defenders should verify affected systems, review system configurations, and implement additional authentication mechanisms.

Official resources