A significant vulnerability has been identified in NASA's AMMOS Instrument Toolkit (AIT)-GUI, an open-source framework used for managing ground data systems that interact with spacecraft and instruments. This flaw allows unauthenticated attackers to issue commands, execute server-side scripts, and run command sequences, which could compromise mission-critical operations. The vulnerability, known as GHSA-p9r8-2q67-fp86, affects AIT-GUI versions up to 2.5.1 and has a CVSS score of 9.4, indicating severe impact. The issue has been addressed with the release of AIT-GUI version 2.5.2. Cycode researcher Yuval Elbar disclosed the vulnerability on August 18, highlighting that the web server starts on all network interfaces rather than adhering to its configured host setting. Moreover, the API lacks essential security features such as authentication, authorization, and cross-site request forgery protection for endpoints that change state. These vulnerabilities are particularly concerning because they exist within the operational technology environment, where basic access control failures can lead to high-impact security breaches. Attackers do not need direct network access to exploit this flaw, as the vulnerable endpoints accept browser-compatible form submissions. This means a malicious website could potentially target an operator's browser, enabling cross-origin requests without the need for a CORS preflight. To mitigate these risks, the project team recommends implementing authentication and authorization for state-changing endpoints, adding CSRF protection, binding the server to its configured host, and confining paths for affected routes. NASA and JPL have been contacted for further comment on the situation.