CVE-2026-105105

{
  "etk_id": "ETK-2026-455",
  "cve_id": "CVE-2026-105105",
  "display_id": "CVE-2026-105105",
  "ghsa_id": "GHSA-9xfm-37f4-2h8g",
  "euvd_id": "EUVD-2026-92014",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Missing authentication in AIT-Core telemetry and command broker",
  "summary": "AIT-Core ait-server installations through 3.1.1 may expose the ZeroMQ telemetry and command broker without access controls. An unauthenticated party that can reach that broker may read, forge, inject, or interfere with command and telemetry traffic.",
  "mitigation": "Upgrade AIT-Core to version 3.1.2. Until upgraded, restrict ZeroMQ broker access to trusted local or management networks and block untrusted connections to its message-bus ports.",
  "vendor": "nasa-ammos",
  "product": "AIT-Core",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 3.1.1"
      ],
      "ecosystem": "pypi",
      "fixed_versions": [],
      "package_name": "ait-core",
      "purl": "pkg:pypi/ait-core"
    }
  ],
  "cwes": null,
  "cvss_score": 9.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": 0.0078,
  "epss_percentile": 0.5528,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 18.35923225,
  "t0_at": "2026-10-03T11:55:44.853000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-03T11:55:44.853000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-03T11:55:44.853000+00:00",
      "url": "https://github.com/advisories/GHSA-9xfm-37f4-2h8g"
    }
  }
}