NASA-AMMOS vulnerabilities
We track 6 vulnerabilities in NASA-AMMOS products across 5 products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on October 3, 2026.
Latest NASA-AMMOS vulnerabilities
- 9.8 Critical severity
AIT-Core: Missing Authentication for Critical Functionality
CWE-306: Missing Authentication for Critical Function in the ait.core.server telemetry and command broker (ait-server) in NASA-AMMOS AIT-Core through 3.1.1 allows an unauthenticated remote attacker with network access to the ZeroMQ message bus to inject spacec
- 9.8 Critical severity
anms: Missing Authentication for Critical Functionality
The NASA-AMMOS Asynchronous Network Management System (ANMS) reference implementation's default docker-compose.yml publishes the amp-manager service's REST API directly to the host network interface (port 8089, e.g. ":8089/tcp") with cap_add: NET_ADMIN, NET_RA
- 9.8 Critical severity
plandev (sequencing-server): Missing Authentication for Critical Functionality
The Aerie/PlanDev sequencing-server's authorization middleware (sequencing-server/src/app.ts) derives the caller's Hasura session role via getHasuraSession, which prefers a session_variables object taken directly from the client-supplied JSON request body over
- 9.8 Critical severity
AIT-DSN: Missing Authentication for Critical Functionality
AMMOS Instrument Toolkit (AIT) Deep Space Network (DSN) Interface before 2.2.2 contains a missing authentication vulnerability in the Space Link Extension (SLE) interface manager that allows unauthenticated network attackers to access seven unprotected API rou
- 9.8 Critical severity
AIT-GUI: Missing Authentication for Critical Functionality
AMMOS Instrument Toolkit (AIT) GUI before 2.5.1 contains a missing authentication vulnerability that allows any unauthenticated network attacker to obtain a valid session and issue arbitrary spacecraft commands by calling Sessions.create() without any credenti
- 9.1 Critical severity
AIT-Core: Improper Limitation of a Pathname to a Restricted Directory
The AMMOS Instrument Toolkit (Formerly the Bespoke Links to Instruments for Surface and Space (BLISS)) is a Python-based software suite developed to handle Ground Data System (GDS), Electronic Ground Support Equipment (EGSE), commanding, telemetry uplink/downl