CVE-2026-71214 NASA-AMMOS CVE debrief

Who should care

Users and administrators of the Aerie/PlanDev sequencing-server, as well as anyone responsible for securing spacecraft activities and command translation systems, should review and update the authorization middleware to properly verify the request origin and ensure that only authenticated requests can modify expansion rules and command dictionaries. Additionally, users and administrators should implement authentication and authorization checks for all endpoints that modify sensitive data, including /command-expansion/put-expansion and /put-dictionary, and remove unauthenticated write access to sequencing.expansion_rule and command dictionaries.

Technical summary

The Aerie/PlanDev sequencing-server's authorization middleware derives the caller's Hasura session role via getHasuraSession(), which prefers a session_variables object taken directly from the client-supplied JSON request body over the Authorization header's JWT claims, with no verification that the request actually originated from Hasura. This allows an unauthenticated attacker to satisfy the role check and insert arbitrary expansion rules into sequencing.expansion_rule by setting {session_variables:{x-hasura-role:aerie_admin}} in the body of a request to POST /command-expansion/put-expansion with no Authorization header. Separately, POST /put-dictionary is explicitly listed in the ENDPOINTS_WHITELIST and is exempt from any authentication, allowing unauthenticated writes of command dictionaries.

Defensive priority

Critical vulnerability in Aerie/PlanDev sequencing-server allows unauthenticated attackers to insert arbitrary expansion rules and write command dictionaries.

Recommended defensive actions

• Review and update the authorization middleware to properly verify the request origin and ensure that only authenticated requests can modify expansion rules and command dictionaries.
• Implement authentication and authorization checks for all endpoints that modify sensitive data, including /command-expansion/put-expansion and /put-dictionary.
• Remove unauthenticated write access to sequencing.expansion_rule and command dictionaries.
• Monitor for suspicious activity on the affected endpoints and implement logging and alerting to detect potential exploitation attempts.
• Consider implementing additional security controls, such as rate limiting and IP blocking, to prevent abuse of the affected endpoints.

Evidence notes

The CVE description details a critical vulnerability in the Aerie/PlanDev sequencing-server's authorization middleware. The vulnerability allows an unauthenticated attacker to insert arbitrary expansion rules into sequencing.expansion_rule and write command dictionaries via unauthenticated requests to specific endpoints.

Official resources