CVE-2026-71289CWE-306

CVE-2026-71289

Critical · published August 5, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
51.9
In the wild
Unconfirmed
What it is

The NASA-AMMOS Asynchronous Network Management System (ANMS) reference implementation's default docker-compose.yml publishes the amp-manager service's REST API directly to the host network interface (port 8089, e.g. ":8089/tcp") with cap_add: NET_ADMIN, NET_RAW, SYS_NICE, bypassing the CAM (Configuration and Access Manager) gateway that is otherwise the system's sole authentication boundary.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00682 · 51.9th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-08-05T17:24Z
References (2)
https://github.com/JHUAPL-DTNMA/dtnma-tools · 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2chttps://github.com/NASA-AMMOS/anms · 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
EPSS history
Timeline
  • 05 AUG 12:26Z
    NASA-AMMOS ANMS / JHUAPL dtnma-tools Unauthenticated Remote Command Execution via Exposed AMP Manager REST API
    cvelistv5