Authorization Flaw in Aerie/PlanDev Sequencing-Server by NASA

CVE-2026-71214

What is CVE-2026-71214?

The Aerie/PlanDev sequencing-server contains a serious authorization weakness where the middleware improperly derives session roles from client-input data. This occurs via a session_variables object in the JSON request body, undermining the integrity of role verification by neglecting to authenticate the request source. Consequently, an unauthenticated attacker can manipulate role assignments, allowing them to insert unauthorized commands into critical expansion rules for spacecraft operations. Furthermore, the design of the POST /put-dictionary endpoint permits unauthenticated writes, exacerbating the risk by enabling malicious alterations to command dictionaries.

References