CVE-2026-71289

Received Received - Intake

Unauthenticated Command Execution in NASA ANMS

Publication date: 2026-08-05

Last updated on: 2026-08-10

Assigner: TuranSec

Description

The NASA-AMMOS Asynchronous Network Management System (ANMS) reference implementation's default docker-compose.yml publishes the amp-manager service's REST API directly to the host network interface (port 8089, e.g. ":8089/tcp") with cap_add: NET_ADMIN, NET_RAW, SYS_NICE, bypassing the CAM (Configuration and Access Manager) gateway that is otherwise the system's sole authentication boundary.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-05

Last Modified

2026-08-10

Generated

2026-08-25

AI Q&A

2026-08-05

EPSS Evaluated

2026-08-24

NVD

CVE-2026-71289

EUVD

EUVD-2026-53374

Affected Vendors & Products

Vendor	Product	Version / Range
nasa_ammos	anms	*
jhuapl_dtnma	dtnma_tools	*
nasa	anms	*
jhuapl	dtnma_tools	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability involves the NASA-AMMOS Asynchronous Network Management System (ANMS) default docker-compose.yml exposing the amp-manager service's REST API directly on the host network interface (port 8089) without proper authentication. The REST server, using CivetWeb, is configured with no authentication checks, allowing any network-reachable client to interact with DTNMA agents, submit commands, and clear reports without credentials.

Detection Guidance

Check if the amp-manager service's REST API port (default 8089) is exposed on the host network interface by running: netstat -tulnp | grep 8089 or ss -tulnp | grep 8089. Verify if the Docker container has NET_ADMIN, NET_RAW, and SYS_NICE capabilities enabled using: docker inspect <container_name> | grep CapAdd.

Impact Analysis

An attacker could exploit this to enumerate registered agents, send arbitrary commands to DTNMA agents, and delete stored reports. This could lead to unauthorized control of connected systems, data manipulation, or disruption of network operations, depending on the deployment context.

Compliance Impact

This vulnerability could violate compliance requirements related to data integrity, access control, and audit logging. Unauthorized command execution and data deletion may breach GDPR's data protection principles or HIPAA's security rules for protected health information, depending on the system's use case.

Mitigation Strategies

Immediately stop exposing the amp-manager service port on the host network. Modify the docker-compose.yml to bind the port only to localhost (e.g., 127.0.0.1:8089:8089) or remove the port mapping entirely. Ensure authentication is enabled in the REST server configuration by setting enable_auth_domain_check to yes.

Hi! I’m here to help you understand CVE-2026-71289. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70