CVE-2026-71289
Received Received - Intake

Unauthenticated Command Execution in NASA ANMS

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
The NASA-AMMOS Asynchronous Network Management System (ANMS) reference implementation's default docker-compose.yml publishes the amp-manager service's REST API directly to the host network interface (port 8089, e.g. "${ION_MGR_PORT:-8089}:8089/tcp") with cap_add: NET_ADMIN, NET_RAW, SYS_NICE, bypassing the CAM (Configuration and Access Manager) gateway that is otherwise the system's sole authentication boundary. The underlying REST server, implemented with CivetWeb in JHUAPL/dtnma-tools (src/refdm/nm_rest.c), is configured with enable_auth_domain_check set to "no" and registers every route, including the DTNMA agent command-dispatch endpoints (.../agents/{eid|idx}/send, which accept and forward EXECSET-encoded command sets to a registered DTNMA agent), with a null authentication callback. Any network-reachable client can therefore enumerate registered agents, submit arbitrary command sets to them, and clear stored reports, entirely without credentials. This affects NASA-AMMOS/anms and JHUAPL-DTNMA/dtnma-tools as published; both repositories present this as a reference/ground DTN network-management implementation and testbed, and the affected components communicate with DTNMA agents (which may represent simulated or real spacecraft/ground nodes depending on deployment) rather than being flight software running onboard a spacecraft.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-71289
EUVD
EUVD-2026-53374

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
nasa_ammos anms *
jhuapl_dtnma dtnma_tools *
nasa anms *
jhuapl dtnma_tools *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves the NASA-AMMOS Asynchronous Network Management System (ANMS) default docker-compose.yml exposing the amp-manager service's REST API directly on the host network interface (port 8089) without proper authentication. The REST server, using CivetWeb, is configured with no authentication checks, allowing any network-reachable client to interact with DTNMA agents, submit commands, and clear reports without credentials.

Detection Guidance

Check if the amp-manager service's REST API port (default 8089) is exposed on the host network interface by running: netstat -tulnp | grep 8089 or ss -tulnp | grep 8089. Verify if the Docker container has NET_ADMIN, NET_RAW, and SYS_NICE capabilities enabled using: docker inspect <container_name> | grep CapAdd.

Impact Analysis

An attacker could exploit this to enumerate registered agents, send arbitrary commands to DTNMA agents, and delete stored reports. This could lead to unauthorized control of connected systems, data manipulation, or disruption of network operations, depending on the deployment context.

Compliance Impact

This vulnerability could violate compliance requirements related to data integrity, access control, and audit logging. Unauthorized command execution and data deletion may breach GDPR's data protection principles or HIPAA's security rules for protected health information, depending on the system's use case.

Mitigation Strategies

Immediately stop exposing the amp-manager service port on the host network. Modify the docker-compose.yml to bind the port only to localhost (e.g., 127.0.0.1:8089:8089) or remove the port mapping entirely. Ensure authentication is enabled in the REST server configuration by setting enable_auth_domain_check to yes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71289. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart