CVE-2026-71214

{
  "id": "CVE-2026-71214",
  "sourceIdentifier": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
  "published": "2026-08-05T08:16:43.807",
  "lastModified": "2026-10-24T15:10:00.190",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Aerie/PlanDev sequencing-server's authorization middleware (sequencing-server/src/app.ts) derives the caller's Hasura session role via getHasuraSession, which prefers a session_variables object taken directly from the client-supplied JSON request body over the Authorization header's JWT claims, with no verification that the request actually originated from Hasura."
    },
    {
      "lang": "es",
      "value": "El middleware de autorización del sequencing-server de Aerie/PlanDev (sequencing-server/src/app.ts) deriva el rol de sesión de Hasura del llamador a través de getHasuraSession(), que prefiere un objeto session_variables tomado directamente del cuerpo de la solicitud JSON suministrado por el cliente sobre las reclamaciones JWT del encabezado Authorization, sin verificación de que la solicitud realmente se originó en Hasura. Al establecer {’session_variables’:{’x-hasura-role’:’aerie_admin’}} en el cuerpo de una solicitud a POST /command-expansion/put-expansion sin encabezado Authorization, un atacante no autenticado satisface la verificación de rol y puede insertar reglas de expansión arbitrarias en sequencing.expansion_rule, que rigen cómo las actividades de la nave espacial se traducen en comandos. Por separado, POST /put-dictionary está explícitamente listado en la ENDPOINTS_WHITELIST y está exento de cualquier autenticación, permitiendo escrituras no autenticadas de diccionarios de comandos."
    }
  ],
  "affected": [
    {
      "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
      "affectedData": [
        {
          "vendor": "NASA-AMMOS",
          "product": "plandev (sequencing-server)",
          "defaultStatus": "unknown",
          "programFiles": [
            "sequencing-server/src/app.ts",
            "sequencing-server/src/utils/hasura.ts"
          ],
          "versions": [
            {
              "version": "0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-05T13:27:50.535716Z",
          "id": "CVE-2026-71214",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-306"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/NASA-AMMOS/plandev",
      "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"
    }
  ]
}