CVE-2026-60112

This vulnerability exposes a fundamental design failure rather than a broken authentication check. Sessions.create() never implemented credential verification at all — it simply issued valid sessions to any caller. This is why standard SAST tools and code review processes looking for 'failed authentication' found nothing: there was no check to fail. The absence wasn't a gap; it was an architectural assumption that network isolation constituted authentication, a doctrine common in space systems where physical access to ground stations was historically the threat model. The attack path is direct: create a session via the undocumented Sessions.create() method, invoke handle_cmd(), and commands route straight to the AIT command bus. There are no intermediate validation gates, rate limits, or confirmation steps. Once you have a session token — which this vulnerability grants trivially — the command bus treats it as fully trusted. Detection requires a different approach than standard auth-bypass scanning. Look for any endpoint where application-layer security depends entirely on network-layer isolation — this architectural smell indicates a missing authentication layer, not a broken one. Review your trust boundaries: if 'only trusted network clients can reach this' is the only access control, authentication is absent, not assured. The EPSS score of 0.00408 badly mischaracterizes this risk. The model assumes an internet-scale attacker population with uniform exploitation probability — inapplicable when the attacker pool is two to three nation-state actors with spacecraft-specific knowledge. For operational space infrastructure, probability-of-exploitation is the wrong frame; what matters is consequence magnitude. Even a 0.0001% exploitation probability warrants urgent mitigation when the outcome is loss of spacecraft command authority. If you're operating affected ground station software, understand that the patch to 2.5.1 introduces authentication where none existed. This breaks any integration, mission planning tool, or third-party consumer that was calling Sessions.create() with the expectation of network-isolation-based access. Coordinate patch deployment across all downstream systems simultaneously — a single unpatched integration partner reopens the attack chain. The remediation window isn't just time-to-patch; it's time-to-coordinate regression testing across partners who may have months-long validation cycles.

Reviewed through automated stages and approved by a human before publication.