CVE-2026-71214

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-71214", "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "state": "PUBLISHED", "assignerShortName": "TuranSec", "dateReserved": "2026-08-05T06:56:15.799Z", "datePublished": "2026-08-05T06:59:32.771Z", "dateUpdated": "2026-08-10T11:45:23.694Z"}, "containers": {"cna": {"title": "NASA-AMMOS plandev - Client-Supplied session_variables Bypass Hasura-Origin Authorization in sequencing-server", "descriptions": [{"lang": "en", "value": "The Aerie/PlanDev sequencing-server's authorization middleware (sequencing-server/src/app.ts) derives the caller's Hasura session role via getHasuraSession, which prefers a session_variables object taken directly from the client-supplied JSON request body over the Authorization header's JWT claims, with no verification that the request actually originated from Hasura.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>The Aerie/PlanDev sequencing-server's authorization middleware (sequencing-server/src/app.ts) derives the caller's Hasura session role via getHasuraSession, which prefers a session_variables object taken directly from the client-supplied JSON request body over the Authorization header's JWT claims, with no verification that the request actually originated from Hasura.</p>"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-306 Missing Authentication for Critical Function", "cweId": "CWE-306", "type": "CWE"}]}], "affected": [{"vendor": "NASA-AMMOS", "product": "plandev (sequencing-server)", "programFiles": ["sequencing-server/src/app.ts", "sequencing-server/src/utils/hasura.ts"], "versions": [{"version": "0", "status": "affected"}], "defaultStatus": "unknown"}], "metrics": [{"other": {"type": "CVSS_3.1_severity", "content": {"value": "CRITICAL"}}}, {"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}}], "references": [{"url": "https://github.com/NASA-AMMOS/plandev", "tags": ["third-party-advisory"]}], "credits": [{"lang": "en", "value": "Sardor Shoakbarov", "type": "finder"}], "providerMetadata": {"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "shortName": "TuranSec", "dateUpdated": "2026-08-10T11:45:23.694Z"}, "source": {"discovery": "EXTERNAL"}, "datePublic": "2026-08-05T06:59:32.771Z"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-05T13:27:50.535716Z", "id": "CVE-2026-71214", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-05T13:28:04.613Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-71214", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-05T13:27:50.535716Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-05T13:27:53.823Z"}}], "cna": {"title": "NASA-AMMOS plandev - Client-Supplied session_variables Bypass Hasura-Origin Authorization in sequencing-server", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Sardor Shoakbarov"}], "metrics": [{"other": {"type": "CVSS_3.1_severity", "content": {"value": "CRITICAL"}}}, {"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "NASA-AMMOS", "product": "plandev (sequencing-server)", "versions": [{"status": "affected", "version": "0"}], "programFiles": ["sequencing-server/src/app.ts", "sequencing-server/src/utils/hasura.ts"], "defaultStatus": "unknown"}], "datePublic": "2026-08-05T06:59:32.771Z", "references": [{"url": "https://github.com/NASA-AMMOS/plandev", "tags": ["third-party-advisory"]}], "descriptions": [{"lang": "en", "value": "The Aerie/PlanDev sequencing-server's authorization middleware (sequencing-server/src/app.ts) derives the caller's Hasura session role via getHasuraSession, which prefers a session_variables object taken directly from the client-supplied JSON request body over the Authorization header's JWT claims, with no verification that the request actually originated from Hasura.", "supportingMedia": [{"type": "text/html", "value": "<p>The Aerie/PlanDev sequencing-server's authorization middleware (sequencing-server/src/app.ts) derives the caller's Hasura session role via getHasuraSession, which prefers a session_variables object taken directly from the client-supplied JSON request body over the Authorization header's JWT claims, with no verification that the request actually originated from Hasura.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "CWE-306 Missing Authentication for Critical Function"}]}], "providerMetadata": {"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "shortName": "TuranSec", "dateUpdated": "2026-08-10T11:45:23.694Z"}}}, "cveMetadata": {"cveId": "CVE-2026-71214", "state": "PUBLISHED", "dateUpdated": "2026-08-10T11:45:23.694Z", "dateReserved": "2026-08-05T06:56:15.799Z", "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "datePublished": "2026-08-05T06:59:32.771Z", "assignerShortName": "TuranSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "plandev (sequencing-server)", "programFiles": ["sequencing-server/src/app.ts", "sequencing-server/src/utils/hasura.ts"], "vendor": "NASA-AMMOS", "versions": [{"status": "affected", "version": "0"}]}], "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Aerie/PlanDev sequencing-server's authorization middleware (sequencing-server/src/app.ts) derives the caller's Hasura session role via getHasuraSession, which prefers a session_variables object taken directly from the client-supplied JSON request body over the Authorization header's JWT claims, with no verification that the request actually originated from Hasura."}, {"lang": "es", "value": "El middleware de autorizaci\u00f3n del sequencing-server de Aerie/PlanDev (sequencing-server/src/app.ts) deriva el rol de sesi\u00f3n de Hasura del llamador a trav\u00e9s de getHasuraSession(), que prefiere un objeto session_variables tomado directamente del cuerpo de la solicitud JSON suministrado por el cliente sobre las reclamaciones JWT del encabezado Authorization, sin verificaci\u00f3n de que la solicitud realmente se origin\u00f3 en Hasura. Al establecer {\u2019session_variables\u2019:{\u2019x-hasura-role\u2019:\u2019aerie_admin\u2019}} en el cuerpo de una solicitud a POST /command-expansion/put-expansion sin encabezado Authorization, un atacante no autenticado satisface la verificaci\u00f3n de rol y puede insertar reglas de expansi\u00f3n arbitrarias en sequencing.expansion_rule, que rigen c\u00f3mo las actividades de la nave espacial se traducen en comandos. Por separado, POST /put-dictionary est\u00e1 expl\u00edcitamente listado en la ENDPOINTS_WHITELIST y est\u00e1 exento de cualquier autenticaci\u00f3n, permitiendo escrituras no autenticadas de diccionarios de comandos."}], "id": "CVE-2026-71214", "lastModified": "2026-10-24T15:10:00.190", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-71214", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-05T13:27:50.535716Z", "version": "2.0.3"}}]}, "published": "2026-08-05T08:16:43.807", "references": [{"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "url": "https://github.com/NASA-AMMOS/plandev"}], "sourceIdentifier": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-306"}], "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "plandev (sequencing-server)", "source": "cna", "vendor": "NASA-AMMOS"}, "product": "plandev_(sequencing-server)", "vendor": "nasa-ammos"}], "created": "2026-08-05T08:45:16.717210+00:00", "updated": "2026-08-10T22:30:06.630519+00:00", "vendors": ["nasa-ammos", "nasa-ammos$PRODUCT$plandev_(sequencing-server)"]}