CVE-2026-60113CWE-306

CVE-2026-60113

Critical · published July 29, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
57.2
In the wild
Unconfirmed
What it is

AMMOS Instrument Toolkit (AIT) Deep Space Network (DSN) Interface before 2.2.2 contains a missing authentication vulnerability in the Space Link Extension (SLE) interface manager that allows unauthenticated network attackers to access seven unprotected API routes by sending direct HTTP requests with no credentials. Attackers can reach the exposed SLE endpoints to start or stop Deep Space Network communication sessions, retrieve telemetry frame data, and inject arbitrary frames into active spacecraft links.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00833 · 57.2th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-07-29T20:17Z
Affected products (1)
ProductVersionsFixed in
nasa/ait_dsn< 2.2.22.2.2
References (6)
https://github.com/NASA-AMMOS/AIT-DSN/blob/master/CHANGELOG.md#222---2026-07-13 · [email protected]https://github.com/NASA-AMMOS/AIT-DSN/commit/06d07d1a525602c62c6eaeaeff2544196f430340 · [email protected]https://github.com/NASA-AMMOS/AIT-DSN/releases/tag/2.2.2 · [email protected]https://github.com/NASA-AMMOS/AIT-DSN/security/advisories/GHSA-gj83-67wr-82mv · [email protected]https://www.vulncheck.com/advisories/ait-dsn-missing-authentication-via-sle-api-routes · [email protected]https://github.com/NASA-AMMOS/AIT-DSN/security/advisories/GHSA-gj83-67wr-82mv · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 29 JUL 15:40Z
    AIT-DSN < 2.2.2 Missing Authentication via SLE API Routes
    cvelistv5