CVE-2026-105105 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2026-105105 requires immediate attention.

· 6 min read

Executive Summary

CVE-2026-105105 is a critical authentication bypass in NASA-AMMOS AIT-Core’s telemetry and command broker (ait-server) affecting versions through 3.1.1. A remote attacker who can reach the ZeroMQ bus can inject spacecraft command data, read command and telemetry traffic, forge telemetry, or disrupt the command/telemetry path. The default broker binds to all network interfaces without authentication or transport security, which makes exposed deployments especially dangerous. AIT-Core 3.1.2 changes the default bind addresses to loopback, reducing exposure, but you should still harden access immediately.

Immediate Action

  • Upgrade now: move to AIT-Core 3.1.2 or later as soon as possible.
  • Isolate the broker: restrict TCP 5559 and 5560 to localhost or a tightly controlled management network.
  • Rollback if needed: if upgrading breaks workflows, temporarily pin the service behind a firewall/VPN rather than leaving it exposed.
  • Disable external access: do not expose the ZeroMQ bus to the public internet or shared office networks.
  • Review vendor guidance: see the vendor advisory / release notes and your internal runbook.

Affected Versions

  • ait.core.server / ait-server@<=3.1.1 vulnerable; upgrade to 3.1.2+.
  • AIT-Core 3.1.2 and later: default ZeroMQ bind addresses changed to loopback, reducing default exposure.
  • If you have custom configs that bind to 0.0.0.0 or public interfaces, treat them as vulnerable until corrected.

Resolution Guide

Python / pip

python -m pip install --upgrade "AIT-Core>=3.1.2"
# or, if you pin versions:
python -m pip install "AIT-Core==3.1.2"

pipx

pipx upgrade ait-core
# if the package name differs in your environment, pin to 3.1.2+

JavaScript / npm, yarn, pnpm

# Only if you vendor or wrap AIT tooling in JS automation
npm install ait-core@3.1.2
yarn add ait-core@3.1.2
pnpm add ait-core@3.1.2

Java / Maven, Gradle

<dependency>
  <groupId>TODO.groupId</groupId>
  <artifactId>TODO.artifactId</artifactId>
  <version>3.1.2</version>
</dependency>
dependencies {
  implementation "TODO.groupId:TODO.artifactId:3.1.2"
}

Linux packages

# apt
sudo apt update
sudo apt install --only-upgrade ait-core

# yum/dnf
sudo yum update ait-core
# or
sudo dnf upgrade ait-core

Docker

docker pull TODO_REGISTRY/ait-core:3.1.2
docker run --rm -p 127.0.0.1:5559:5559 -p 127.0.0.1:5560:5560 TODO_REGISTRY/ait-core:3.1.2

Config hardening

# Bind only to localhost or a private management interface
XSUB_BIND=tcp://127.0.0.1:5559
XPUB_BIND=tcp://127.0.0.1:5560

# If your deployment supports it, add firewall rules:
sudo ufw deny 5559/tcp
sudo ufw deny 5560/tcp

Minimal code/config patch example

# Before: exposed to all interfaces
xsub_bind = "tcp://0.0.0.0:5559"
xpub_bind = "tcp://0.0.0.0:5560"

# After: loopback only
xsub_bind = "tcp://127.0.0.1:5559"
xpub_bind = "tcp://127.0.0.1:5560"

Detection & Verification

Check version:

python -c "import ait; print(getattr(ait, '__version__', 'unknown'))"
pip show AIT-Core
pip freeze | grep -i '^AIT-Core=='

Find exposed binds:

grep -RInE '5559|5560|0\.0\.0\.0|tcp://\*|XPUB|XSUB' /etc /opt /srv 2>/dev/null

Check listening sockets:

ss -ltnp | grep -E '(:5559|:5560)\b'
# or
netstat -ltnp | grep -E '(:5559|:5560)\b'

Dependency audit:

pip-audit
python -m pip check
# If you use containers:
docker inspect TODO_IMAGE:TAG | grep -E '5559|5560|127.0.0.1|0.0.0.0'

Verify the fix: confirm the broker only listens on 127.0.0.1 (or a private interface you intended), and that 5559/5560 are blocked from untrusted networks. Re-run the version check and confirm 3.1.2+.

Risk and Impact

This bug can let an attacker on the same reachable network inject commands, read sensitive telemetry, or disrupt the command bus without logging in. For small teams, the blast radius is high because a single exposed broker can affect all connected tooling and downstream automation. If your service is internet-facing or reachable from a shared LAN, treat this as an immediate incident-response priority.

Keep reading