Company Details
nasa
50,451
6,877,886
3364
nasa.gov
0
NAS_4658716
In-progress


NASA - National Aeronautics and Space Administration Vendor Cyber Rating & Cyber Score
nasa.govFor more than 60 years, NASA has been breaking barriers to achieve the seemingly impossible—from walking on the Moon to pushing the boundaries of human spaceflight farther than ever before. We work in space and around the world in laboratories and wind tunnels, on airfields and in control rooms to explore some of life’s fundamental mysteries: What’s out there in space? How do we get there? And what can we learn that will make life better here on Earth? We are passionate professionals united by a common purpose: to pioneer the future in space exploration, scientific discovery and aeronautics research. Today, we continue NASA’s legacy of excellence and innovation through an unprecedented array of missions. We are developing the most advanced rockets and spacecraft ever designed, studying the Earth for answers to critical challenges facing our planet, improving the air transportation experience, and so much more. Join us as we reach for new heights and reveal the unknown for the benefit of humanity.
Company Details
nasa
50,451
6,877,886
3364
nasa.gov
0
NAS_4658716
In-progress
Between 800 and 849

NNASA Global Score (TPRM)XXXX

Description: A small but persistent air leak in a Russian compartment of the International Space Station has prompted NASA and Axiom Space to indefinitely delay the launch of a commercial flight to the orbiting outpost. The flight was delayed due to high winds and an oxygen leak in the Falcon 9 rocket's first stage. NASA engineers needed more time to assess efforts to plug an air leak aboard the ISS in a Russian vestibule known as the PrK. The PrK serves as a passageway between the station's Zvezda module and spacecraft docked at its aft port.
Description: Vulnerabilities in open source software developed and used in-house by NASA could be exploited to breach their systems. Security researcher Leon Juranić discovered stack-based buffer overflow vulnerabilities in NASA’s software, which could allow for remote code execution. These vulnerabilities were found in tools such as QuIP, OpenVSP, RHEAS, OMINAS, Refine, CFDTOOLS, and the knife library. Juranić also found reflected XSS vulnerabilities and hard-coded secret values in NASA’s web applications. State-sponsored threat actors could exploit these flaws to compromise NASA's systems and those of other institutions using the vulnerable software.
Description: NASA’s computers were shut down for about 21 days by a young hacker in 1999. The hacker was able to gain access to 13 computers at the Marshall Space Flight Center and downloaded $1.7 million worth of NASA proprietary software. He was able to access thousands of messages, usernames, passwords, and source code for the International Space Station. The attack cost NASA a total of $41,000 to get systems back on track.


No incidents recorded for NASA - National Aeronautics and Space Administration in 2026.
No incidents recorded for NASA - National Aeronautics and Space Administration in 2026.
No incidents recorded for NASA - National Aeronautics and Space Administration in 2026.
NNASA cyber incidents detection timeline including parent company and subsidiaries

For more than 60 years, NASA has been breaking barriers to achieve the seemingly impossible—from walking on the Moon to pushing the boundaries of human spaceflight farther than ever before. We work in space and around the world in laboratories and wind tunnels, on airfields and in control rooms to explore some of life’s fundamental mysteries: What’s out there in space? How do we get there? And what can we learn that will make life better here on Earth? We are passionate professionals united by a common purpose: to pioneer the future in space exploration, scientific discovery and aeronautics research. Today, we continue NASA’s legacy of excellence and innovation through an unprecedented array of missions. We are developing the most advanced rockets and spacecraft ever designed, studying the Earth for answers to critical challenges facing our planet, improving the air transportation experience, and so much more. Join us as we reach for new heights and reveal the unknown for the benefit of humanity.


B/E Aerospace is now part of Rockwell Collins. With the acquisition of B/E Aerospace in April 2017, Rockwell Collins is now a world leader in designing, developing and manufacturing cabin interior products and services that deliver innovation, reliability and efficiency. Our broad range of offeri

Pratt & Whitney, an RTX business, is a global leader in propulsion systems, powering the most advanced aircraft in the world, and we are shaping the future of aviation. Our engines help connect people, grow economies and defend freedom. Our customers depend on us to get where they’re going and back

Airbus pioneers sustainable aerospace for a safe and united world. The Company constantly innovates to provide efficient and technologically-advanced solutions in aerospace, defence, and connected services. In commercial aircraft, Airbus designs and manufactures modern and fuel-efficient airliners
A global aerospace company headquartered in Brazil, Embraer has businesses in Commercial and Executive Aviation, Defense & Security, and Agricultural Aviation. The company designs, develops, manufactures and markets aircraft and systems, providing Services and Support to customer after-sales. Sinc
We are building a road to space for the benefit of Earth, humanity’s blue origin. Our team is focused on radically reducing the cost of access to space and harnessing its vast resources while mobilizing future generations to realize this mission. Blue Origin builds reusable rocket engines, launch ve

SpaceX designs, manufactures and launches the world’s most advanced rockets and spacecraft. The company was founded in 2002 by Elon Musk to revolutionize space transportation, with the ultimate goal of making life multiplanetary. SpaceX has gained worldwide attention for a series of historic mil

Inventing, designing and building what’s best in aerospace. Spirit AeroSystems is one of the world’s largest manufacturers of aerostructures for commercial airplanes, defense platforms, and business/regional jets. With expertise in aluminum and advanced composite manufacturing solutions, the company

At CAE, we exist to make the world safer. We deliver cutting-edge training, simulation, and critical operations solutions to prepare aviation professionals and defence forces for the moments that matter. Every day, we empower pilots, cabin crew, maintenance technicians, airlines, business aviation o

Bombardier is a global leader in aviation, focused on designing, manufacturing, and servicing the world's most exceptional business jets. Bombardier’s Challenger and Global aircraft families are renowned for their cutting-edge innovation, cabin design, performance, and reliability. Bombardier has a
.png)
Zachary Song is a partner at Steptoe in New York and a panellist at this year's Inter-Pacific Bar Association (IPBA) conference for the day...
Keith's note: According to this GAO report: “Chief Information Officer Open Recommendations: National Aeronautics and Space Administration“:...
The National Aeronautics and Space Administration (NASA) has turned to blockchain technology to enhance air travel safety and security.
A Doncaster computer buff has revealed he hacked into space agency NASA – and was then praised by bosses at the US organisation for his...
The U.S. Department of Justice (“DOJ”) has kept busy this summer in pursuing cybersecurity-related fraud in government contracts resulting...
TEMPO.CO, Jakarta - The United States' National Aeronautics and Space Administration (NASA) has officially banned Chinese nationals from...
Amid China's continuous progress in space exploration programs, and against the background of increasing anti-China hysteria in Washington,...
NASA has blocked Chinese citizens with US visas from working on agency programs, people familiar with the matter said, as Washington...
This report examines cyber security risks associated with the use of cloud computing in the ground segment of space systems, particularly in...

Explore insights on cybersecurity incidents, risk posture, and Rankiteo's assessments.
The official website of NASA - National Aeronautics and Space Administration is http://www.nasa.gov.
According to Rankiteo, NASA - National Aeronautics and Space Administration’s AI-generated cybersecurity score is 802, reflecting their Good security posture.
According to Rankiteo, NASA - National Aeronautics and Space Administration currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.
According to Rankiteo, NASA - National Aeronautics and Space Administration has not been affected by any supply chain cyber incidents, and no incident IDs are currently listed for the organization.
According to Rankiteo, NASA - National Aeronautics and Space Administration is not certified under SOC 2 Type 1.
According to Rankiteo, NASA - National Aeronautics and Space Administration does not hold a SOC 2 Type 2 certification.
According to Rankiteo, NASA - National Aeronautics and Space Administration is not listed as GDPR compliant.
According to Rankiteo, NASA - National Aeronautics and Space Administration does not currently maintain PCI DSS compliance.
According to Rankiteo, NASA - National Aeronautics and Space Administration is not compliant with HIPAA regulations.
According to Rankiteo,NASA - National Aeronautics and Space Administration is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.
NASA - National Aeronautics and Space Administration operates primarily in the Aviation and Aerospace Component Manufacturing industry.
NASA - National Aeronautics and Space Administration employs approximately 50,451 people worldwide.
NASA - National Aeronautics and Space Administration presently has no subsidiaries across any sectors.
NASA - National Aeronautics and Space Administration’s official LinkedIn profile has approximately 6,877,886 followers.
NASA - National Aeronautics and Space Administration is classified under the NAICS code 3364, which corresponds to Aerospace Product and Parts Manufacturing.
No, NASA - National Aeronautics and Space Administration does not have a profile on Crunchbase.
Yes, NASA - National Aeronautics and Space Administration maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/nasa.
As of April 04, 2026, Rankiteo reports that NASA - National Aeronautics and Space Administration has experienced 3 cybersecurity incidents.
NASA - National Aeronautics and Space Administration has an estimated 2,783 peer or competitor companies worldwide.
Incident Types: The types of cybersecurity incidents that have occurred include Breach, Vulnerability and Cyber Attack.
Total Financial Loss: The total financial loss from these incidents is estimated to be $41 thousand.
Detection and Response: The company detects and responds to cybersecurity incidents through an containment measures with closing the hatch leading to the prk and the station's aft docking compartment during daily operations, and remediation measures with patching suspect crack and other possible sources of leakage..
Title: NASA Cyber Attack by Hacker in 1999
Description: NASA’s computers were shut down for about 21 days by a young hacker in 1999. The hacker was able to gain access to 13 computers at the Marshall Space Flight Center and downloaded $1.7 million worth of NASA proprietary software. He was able to access thousands of messages, usernames, passwords, and source code for the International Space Station. The attack cost NASA a total of $41,000 to get systems back on track.
Type: Cyber Attack
Attack Vector: Unauthorized Access
Threat Actor: Young Hacker
Title: Vulnerabilities in NASA Open Source Software
Description: Vulnerabilities in open source software developed and used in-house by NASA were discovered by Leon Juranić, security researcher and founder of cybersecurity startup ThreatLeap. The vulnerabilities were found in tools such as QuIP, OpenVSP, RHEAS, OMINAS, Refine, CFDTOOLS, and the knife library. These vulnerabilities include stack-based buffer overflows, reflected cross site scripting (XSS), and hard-coded secret values, which could be exploited for remote code execution.
Type: Vulnerability Exploitation
Attack Vector: Exploitation of vulnerabilities in software
Vulnerability Exploited: Stack-based buffer overflowReflected cross site scripting (XSS)Hard-coded secret values
Threat Actor: Potential state-sponsored threat actors
Motivation: To compromise computer systems at NASA and other institutions using the vulnerable software
Title: Air Leak in Russian Compartment of the International Space Station
Description: Concern about a small but persistent air leak in a Russian compartment of the International Space Station has prompted NASA and Axiom Space to indefinitely delay this week's launch of a commercial flight to the orbiting outpost.
Date Detected: 2019
Type: Hardware Malfunction
Vulnerability Exploited: Aging hardware
Common Attack Types: The most common types of attacks the company has faced is Breach.

Financial Loss: $41,000
Data Compromised: Messages, Usernames, Passwords, Source code for the international space station
Systems Affected: 13 computers at the Marshall Space Flight Center
Downtime: 21 days

Systems Affected: QuIPOpenVSPRHEASOMINASRefineCFDTOOLSknife library

Systems Affected: Russian compartment (PrK) of the ISSZvezda module
Downtime: Indefinite delay of Axiom-4 launch
Operational Impact: Delay in space missions
Average Financial Loss: The average financial loss per incident is $13.67 thousand.
Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Proprietary Software, Messages, Usernames, Passwords, Source Code and .

Entity Name: NASA
Entity Type: Government Agency
Industry: Aerospace

Entity Name: NASA
Entity Type: Government Agency
Industry: Aerospace
Location: United States

Entity Name: NASA
Entity Type: Government Agency
Industry: Space Exploration
Location: Houston, Texas

Entity Name: Axiom Space
Entity Type: Private Company
Industry: Space Exploration

Entity Name: Roscosmos
Entity Type: Government Agency
Industry: Space Exploration
Location: Russia

Containment Measures: Closing the hatch leading to the PrK and the station's aft docking compartment during daily operations
Remediation Measures: Patching suspect crack and other possible sources of leakage

Type of Data Compromised: Proprietary software, Messages, Usernames, Passwords, Source code
Sensitivity of Data: High
Prevention of Data Exfiltration: The company takes the following measures to prevent data exfiltration: Patching suspect crack and other possible sources of leakage, .
Handling of PII Incidents: The company handles incidents involving personally identifiable information (PII) through by closing the hatch leading to the prk and the station's aft docking compartment during daily operations and .

Lessons Learned: The importance of Secure Software Development Life Cycle (SDLC) practices, especially for government agencies and their contractors.

Recommendations: Improvement in NASA's software security processes and NASA's SRA (Software Release Authority) policy.
Key Lessons Learned: The key lessons learned from past incidents are The importance of Secure Software Development Life Cycle (SDLC) practices, especially for government agencies and their contractors.
Implemented Recommendations: The company has implemented the following recommendations to improve cybersecurity: Improvement in NASA's software security processes and NASA's SRA (Software Release Authority) policy..

Source: Cyber Incident Description

Source: Help Net Security

Source: CBS News/NASA
Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: Cyber Incident Description, and Source: Help Net Security, and Source: CBS News/NASA.

Investigation Status: Ongoing

Root Causes: High Cyclic Fatigue Caused By Micro Vibrations, Pressure And Mechanical Stress, Residual Stress, Material Properties, Environmental Exposures,
Last Attacking Group: The attacking group in the last incident were an Young Hacker and Potential state-sponsored threat actors.
Most Recent Incident Detected: The most recent incident detected was on 2019.
Highest Financial Loss: The highest financial loss from an incident was $41,000.
Most Significant Data Compromised: The most significant data compromised in an incident were messages, usernames, passwords, source code for the International Space Station and .
Most Significant System Affected: The most significant system affected in an incident was 13 computers at the Marshall Space Flight Center and QuIPOpenVSPRHEASOMINASRefineCFDTOOLSknife library and Russian compartment (PrK) of the ISSZvezda module.
Containment Measures in Most Recent Incident: The containment measures taken in the most recent incident was Closing the hatch leading to the PrK and the station's aft docking compartment during daily operations.
Most Sensitive Data Compromised: The most sensitive data compromised in a breach were usernames, source code for the International Space Station, passwords and messages.
Most Significant Lesson Learned: The most significant lesson learned from past incidents was The importance of Secure Software Development Life Cycle (SDLC) practices, especially for government agencies and their contractors.
Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was Improvement in NASA's software security processes and NASA's SRA (Software Release Authority) policy..
Most Recent Source: The most recent source of information about an incident are Help Net Security, CBS News/NASA and Cyber Incident Description.
Current Status of Most Recent Investigation: The current status of the most recent investigation is Ongoing.
.png)
nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.3.0, two peer-facing consensus request handlers assume that the history index is always available and call blockchain.history_store.history_index().unwrap() directly. That assumption is false by construction. HistoryStoreProxy::history_index() explicitly returns None for the valid HistoryStoreProxy::WithoutIndex state. when a full node is syncing or otherwise running without the history index, a remote peer can send RequestTransactionsProof or RequestTransactionReceiptsByAddress and trigger an Option::unwrap() panic on the request path. This issue has been patched in version 1.3.0.
PraisonAI is a multi-agent teams system. Prior to version 1.5.95, FileTools.download_file() in praisonaiagents validates the destination path but performs no validation on the url parameter, passing it directly to httpx.stream() with follow_redirects=True. An attacker who controls the URL can reach any host accessible from the server including cloud metadata services and internal network services. This issue has been patched in version 1.5.95.
PraisonAI is a multi-agent teams system. Prior to version 4.5.97, OAuthManager.validate_token() returns True for any token not found in its internal store, which is empty by default. Any HTTP request to the MCP server with an arbitrary Bearer token is treated as authenticated, granting full access to all registered tools and agent capabilities. This issue has been patched in version 4.5.97.
PraisonAI is a multi-agent teams system. Prior to version 4.5.97, the PraisonAI Gateway server accepts WebSocket connections at /ws and serves agent topology at /info with no authentication. Any network client can connect, enumerate registered agents, and send arbitrary messages to agents and their tool sets. This issue has been patched in version 4.5.97.
PraisonAI is a multi-agent teams system. Prior to version 4.5.90, MCPToolIndex.search_tools() compiles a caller-supplied string directly as a Python regular expression with no validation, sanitization, or timeout. A crafted regex causes catastrophic backtracking in the re engine, blocking the Python thread for hundreds of seconds and causing a complete service outage. This issue has been patched in version 4.5.90.

Get company history
Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.
Identify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.
Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.
Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.
Leverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.