Loading vulnerability…
Missing authentication in NASA-AMMOS AIT-Core command and telemetry broker
CVE-2026-105105 is a missing-authentication vulnerability in the ait.core.server telemetry and command broker (ait-server) in NASA-AMMOS AIT-Core through version 3.1.1. The ZeroMQ broker binds its XSUB and XPUB sockets to all network interfaces by default without authentication or transport security. A network-reachable attacker can publish unauthorized command or telemetry messages and subscribe to command and telemetry traffic. Under the shipped default configuration, injected command messages are forwarded through the command stream to the command-uplink UDP path. Exploitation can compromise the confidentiality, integrity, and availability of the command and telemetry bus.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An unauthenticated attacker can exfiltrate command and telemetry traffic, inject spacecraft command data, inject forged telemetry, or disrupt the command and telemetry bus. Injected command messages can reach the configured command-uplink UDP path under the shipped defaults. Successful spacecraft execution of those commands or physical consequences are not established.
If you can’t patch tonight, do this now.
Bind the ZeroMQ broker sockets to loopback when remote access is unnecessary. Restrict network access to TCP ports 5559 and 5560 to trusted systems when remote connectivity is required, preventing untrusted hosts from publishing or subscribing to the bus.
Patch, then assume compromise.
Upgrade to AIT-Core 3.1.2, which changes the default ZeroMQ bind addresses to loopback. Verify that the deployed broker configuration uses loopback bindings, particularly where existing configuration overrides the defaults. This change reduces network exposure; it does not establish authentication or transport security.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.