CVE-2026-71214 Overview
CVE-2026-71214 is an authentication bypass in the NASA-AMMOS Aerie/PlanDev sequencing-server component. The authorization middleware in sequencing-server/src/app.ts derives the caller's Hasura role via getHasuraSession(), which trusts a session_variables object supplied in the client's JSON request body over the Authorization header's JWT claims. The server performs no verification that the request originated from Hasura. An unauthenticated attacker can assert the aerie_admin role by placing it in the request body and insert arbitrary rules into sequencing.expansion_rule, which controls how spacecraft activities are translated into commands. A second flaw exempts POST /put-dictionary from authentication via the ENDPOINTS_WHITELIST, permitting unauthenticated writes to command dictionaries.
Critical Impact
Unauthenticated attackers can inject expansion rules and command dictionaries used to translate spacecraft activities into flight commands, compromising integrity of mission command generation.
Affected Products
- NASA-AMMOS Aerie/PlanDev sequencing-server
- Deployments exposing sequencing-server endpoints without an upstream authenticating proxy
- Downstream mission planning pipelines consuming sequencing.expansion_rule and command dictionaries
Discovery Timeline
- 2026-08-05 - CVE-2026-71214 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-71214
Vulnerability Analysis
The defect is a Missing Authentication for Critical Function issue [CWE-306] in the Express-based sequencing-server. The getHasuraSession() helper in sequencing-server/src/app.ts resolves the caller's role by reading session_variables from the request body when present, falling back to JWT claims from the Authorization header only if the body value is absent. Hasura's action pattern normally forwards session_variables to trusted backend actions, but this server does not validate that the request originated from Hasura via a shared secret, signature, or network boundary.
An attacker sends POST /command-expansion/put-expansion with a JSON body containing {"session_variables":{"x-hasura-role":"aerie_admin"}} and no Authorization header. The middleware treats the caller as an administrator and permits writes to sequencing.expansion_rule. These rules govern translation of planned activities into executable spacecraft commands, so injection here corrupts command generation for downstream operations.
A distinct path exists through POST /put-dictionary, which is listed in ENDPOINTS_WHITELIST and skips authentication entirely. This allows unauthenticated write access to command dictionaries used by the sequencing pipeline.
Root Cause
The server trusts client-controlled input as an authoritative identity source. Role assertion from the request body should never override or replace verified JWT claims, and privileged endpoints must not be added to an authentication bypass list.
Attack Vector
The attack is remote and unauthenticated over the network. The attacker needs only reachability to the sequencing-server HTTP interface and knowledge of the two endpoint paths. No user interaction, tokens, or credentials are required.
The vulnerability is exploited by crafting a plain HTTP request to /command-expansion/put-expansion containing a JSON body with session_variables.x-hasura-role set to aerie_admin, omitting the Authorization header. See the NASA-AMMOS PlanDev repository for the affected middleware source.
Detection Methods for CVE-2026-71214
Indicators of Compromise
- HTTP requests to /command-expansion/put-expansion or /put-dictionary without an Authorization header
- Request bodies containing session_variables with x-hasura-role set to aerie_admin or other privileged roles
- Unexpected inserts or updates to the sequencing.expansion_rule table outside of change windows
- New or modified command dictionary uploads not correlated with an authenticated operator session
Detection Strategies
- Log and alert on any sequencing-server request where the JSON body includes a session_variables key
- Correlate expansion_rule writes in the sequencing database against authenticated Hasura user sessions
- Compare inbound request source IPs to the expected Hasura service address range and flag deviations
Monitoring Recommendations
- Ingest sequencing-server access logs and PostgreSQL audit logs into a centralized analytics platform
- Baseline the volume and origin of writes to expansion_rule and command dictionaries
- Alert on POST /put-dictionary traffic from any client other than the intended Hasura action caller
How to Mitigate CVE-2026-71214
Immediate Actions Required
- Block external network access to the sequencing-server HTTP port and expose it only through an authenticated reverse proxy
- Remove /put-dictionary from ENDPOINTS_WHITELIST and require authentication on all state-changing endpoints
- Modify getHasuraSession() to derive role and user identity exclusively from a verified JWT, never from the request body
- Audit sequencing.expansion_rule and command dictionary tables for unauthorized entries since deployment
Patch Information
No fixed version is listed in the NVD entry at time of publication. Monitor the NASA-AMMOS PlanDev repository for upstream commits addressing the middleware and whitelist logic.
Workarounds
- Enforce a Hasura action shared secret and validate it in sequencing-server middleware before accepting session_variables
- Place sequencing-server behind a mutually authenticated internal network segment reachable only by Hasura
- Apply a reverse-proxy rule that rejects requests whose body contains session_variables when arriving from untrusted sources
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
