SYS::ONLINE
Wasteland.
Briefs1605
Issues21
SinceFeb 2026
LIVE
⚡ Active KEV CVE-2026-60113 2026-07-29

NASA AIT-DSN Exposes Deep Space Network Controls to Unauthenticated Attackers

"A critical missing-authentication flaw (CVE-2026-60113, CVSS 9.8) in NASA-AMMOS AIT-DSN lets unauthenticated network attackers reach Space Link Extension API routes that control Deep Space Network sessions and…"

A critical missing-authentication flaw (CVE-2026-60113, CVSS 9.8) in NASA-AMMOS AIT-DSN lets unauthenticated network attackers reach Space Link Extension API routes that control Deep Space Network sessions and spacecraft link traffic.

What Is It

The AMMOS Instrument Toolkit (AIT) Deep Space Network (DSN) Interface contains a missing authentication vulnerability (CWE-306) in its Space Link Extension (SLE) interface manager. Seven API routes are left unprotected, reachable by sending direct HTTP requests with no credentials at all. The issue was disclosed via VulnCheck and carries a CVSS 3.1 base score of 9.8 (CRITICAL). A CVSS 4.0 secondary score of 9.3 (CRITICAL) is also assigned, with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, network-reachable, low complexity, no privileges, no user interaction.

Why It Matters

This is not an information-disclosure edge case. According to the CVE description, an attacker who reaches the exposed SLE endpoints can:

Frame injection into a live spacecraft link and the ability to terminate DSN sessions are integrity and availability impacts against ground-segment operations, which is consistent with the High/High/High impact rating in the CVSS 4.0 vector. The attack vector is AV:N, so no authentication step and no local or adjacent-network foothold stands between a remote attacker who can reach the service over the network and those functions.

What's Vulnerable

No CPE entries were assigned in the NVD record at the time of publication, and the record is still in Received status (published 2026-07-29).

Patch Status

Fixed in AIT-DSN 2.2.2, released 2026-07-13. The fix is tracked in commit 06d07d1 and documented in GitHub Security Advisory GHSA-gj83-67wr-82mv. Operators running any earlier version should upgrade to 2.2.2.

This CVE does not appear in the CISA Known Exploited Vulnerabilities catalog in the supplied data; no confirmed active exploitation, and no KEV-mandated remediation deadline at this time.

Sources