NASA's AIT-GUI exposed command, script, and sequence functions without authentication or CSRF protection. Even a private deployment could be reached through an operator's browser.