PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-71289 NASA-AMMOS CVE debrief

The NASA-AMMOS Asynchronous Network Management System (ANMS) reference implementation's default docker-compose.yml publishes the amp-manager service's REST API directly to the host network interface (port 8089) with elevated capabilities, bypassing the CAM gateway that is the system's sole authentication boundary. The underlying REST server, implemented with CivetWeb, is configured without authentication for every route, including command-dispatch endpoints that accept and forward EXECSET-encoded command sets to a registered DTNMA agent. This allows any network-reachable client to enumerate registered agents, submit arbitrary command sets, and clear stored reports without credentials.

Vendor
NASA-AMMOS
Product
anms
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-05
Original CVE updated
2026-08-26
Advisory published
2026-08-05
Advisory updated
2026-08-26

Who should care

Organizations using NASA-AMMOS ANMS and JHUAPL-DTNMA dtnma-tools, especially those with exposed REST API endpoints, should prioritize assessment and remediation of this critical vulnerability.

Technical summary

The NASA-AMMOS ANMS reference implementation's default configuration exposes the amp-manager service's REST API on the host network interface (port 8089) with elevated capabilities (NET_ADMIN, NET_RAW, SYS_NICE). The CivetWeb-based REST server is configured without authentication for all routes, including those for command dispatch to DTNMA agents. This enables unauthenticated clients to enumerate agents, submit arbitrary commands, and clear reports.

Defensive priority

High priority due to critical CVSS score of 9.8 and potential for unauthenticated command execution.

Recommended defensive actions

  • Inventory and assess exposure of NASA-AMMOS ANMS and JHUAPL-DTNMA dtnma-tools deployments
  • Implement compensating controls such as network segmentation and access controls
  • Monitor for suspicious activity on port 8089 and DTNMA agent command-dispatch endpoints
  • Apply vendor remediation when available
  • Verify authentication mechanisms are properly configured for REST API endpoints

Evidence notes

Evidence from the NVD and CVE records indicate a critical vulnerability in NASA-AMMOS ANMS and JHUAPL-DTNMA dtnma-tools. The vulnerability allows unauthenticated access to REST API endpoints, enabling agent enumeration, arbitrary command submission, and report clearing. Official records show CVSS score of 9.8 and CRITICAL severity.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-71289 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-71289

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-71289 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-71289

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://github.com/JHUAPL-DTNMA/dtnma-tools

    309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

  • Source reference

    Unverified legacy reference

    URL: https://github.com/NASA-AMMOS/anms

    309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.