CVE-2026-71289 NASA-AMMOS CVE debrief

Who should care

Organizations using NASA-AMMOS ANMS and JHUAPL-DTNMA dtnma-tools, especially those with exposed REST API endpoints, should prioritize assessment and remediation of this critical vulnerability.

Technical summary

The NASA-AMMOS ANMS reference implementation's default configuration exposes the amp-manager service's REST API on the host network interface (port 8089) with elevated capabilities (NET_ADMIN, NET_RAW, SYS_NICE). The CivetWeb-based REST server is configured without authentication for all routes, including those for command dispatch to DTNMA agents. This enables unauthenticated clients to enumerate agents, submit arbitrary commands, and clear reports.

Defensive priority

High priority due to critical CVSS score of 9.8 and potential for unauthenticated command execution.

Recommended defensive actions

• Inventory and assess exposure of NASA-AMMOS ANMS and JHUAPL-DTNMA dtnma-tools deployments
• Implement compensating controls such as network segmentation and access controls
• Monitor for suspicious activity on port 8089 and DTNMA agent command-dispatch endpoints
• Apply vendor remediation when available
• Verify authentication mechanisms are properly configured for REST API endpoints

Evidence notes

Evidence from the NVD and CVE records indicate a critical vulnerability in NASA-AMMOS ANMS and JHUAPL-DTNMA dtnma-tools. The vulnerability allows unauthenticated access to REST API endpoints, enabling agent enumeration, arbitrary command submission, and report clearing. Official records show CVSS score of 9.8 and CRITICAL severity.

Official resources