A critical missing-authentication flaw (CVE-2026-60113, CVSS 9.8) in NASA-AMMOS AIT-DSN lets unauthenticated network attackers reach Space Link Extension API routes that control Deep Space Network sessions and spacecraft link traffic.
What Is It
The AMMOS Instrument Toolkit (AIT) Deep Space Network (DSN) Interface contains a missing authentication vulnerability (CWE-306) in its Space Link Extension (SLE) interface manager. Seven API routes are left unprotected, reachable by sending direct HTTP requests with no credentials at all. The issue was disclosed via VulnCheck and carries a CVSS 3.1 base score of 9.8 (CRITICAL). A CVSS 4.0 secondary score of 9.3 (CRITICAL) is also assigned, with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, network-reachable, low complexity, no privileges, no user interaction.
Why It Matters
This is not an information-disclosure edge case. According to the CVE description, an attacker who reaches the exposed SLE endpoints can:
- Start or stop Deep Space Network communication sessions
- Retrieve telemetry frame data
- Inject arbitrary frames into active spacecraft links
Frame injection into a live spacecraft link and the ability to terminate DSN sessions are integrity and availability impacts against ground-segment operations, which is consistent with the High/High/High impact rating in the CVSS 4.0 vector. The attack vector is AV:N, so no authentication step and no local or adjacent-network foothold stands between a remote attacker who can reach the service over the network and those functions.
What's Vulnerable
- Vendor: NASA-AMMOS
- Product: AIT-DSN (
pkg:github/NASA-AMMOS/AIT-DSN) - Affected versions: all versions before 2.2.2
No CPE entries were assigned in the NVD record at the time of publication, and the record is still in Received status (published 2026-07-29).
Patch Status
Fixed in AIT-DSN 2.2.2, released 2026-07-13. The fix is tracked in commit 06d07d1 and documented in GitHub Security Advisory GHSA-gj83-67wr-82mv. Operators running any earlier version should upgrade to 2.2.2.
This CVE does not appear in the CISA Known Exploited Vulnerabilities catalog in the supplied data; no confirmed active exploitation, and no KEV-mandated remediation deadline at this time.
Sources
- NVD, CVE-2026-60113: https://nvd.nist.gov/vuln/detail/CVE-2026-60113
- GitHub Security Advisory GHSA-gj83-67wr-82mv: https://github.com/NASA-AMMOS/AIT-DSN/security/advisories/GHSA-gj83-67wr-82mv
- VulnCheck Advisory: https://www.vulncheck.com/advisories/ait-dsn-missing-authentication-via-sle-api-routes
- AIT-DSN 2.2.2 Release: https://github.com/NASA-AMMOS/AIT-DSN/releases/tag/2.2.2
- AIT-DSN CHANGELOG (2.2.2): https://github.com/NASA-AMMOS/AIT-DSN/blob/master/CHANGELOG.md#222---2026-07-13
- Fix commit: https://github.com/NASA-AMMOS/AIT-DSN/commit/06d07d1a525602c62c6eaeaeff2544196f430340