CVE-2026-71289 NASA-AMMOS ANMS / JHUAPL dtnma-tools Unauthenticated Remote Command Execution via Exposed AMP Manager REST API
Attackers can execute remote commands with elevated privileges because the default Docker configuration exposes the AMP Manager API without authentication.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-71289?
CVE-2026-71289 is a critical missing authorization vulnerability in NASA-AMMOS anms, published on 5 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The NASA-AMMOS Asynchronous Network Management System (ANMS) reference implementation's default docker-compose.yml publishes the amp-manager service's REST API directly to the host network interface (port 8089, e.g. ":8089/tcp") with cap_add: NET_ADMIN, NET_RAW, SYS_NICE, bypassing the CAM (Configuration and Access Manager) gateway that is otherwise the system's sole authentication boundary.
Weakness: CWE-306
Which versions are affected by CVE-2026-71289?
How do I fix CVE-2026-71289?
No fix has been published for CVE-2026-71289 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-71289 being exploited?
There is no known exploitation of CVE-2026-71289 in the wild and no public exploit code.
Sources
Also known as GHSA-p73q-wm5v-6vh6.