{"id":"CVE-2026-71289","published":"2026-08-05T13:24:53.703","lastModified":"2026-08-10T12:17:31.643","description":"The NASA-AMMOS Asynchronous Network Management System (ANMS) reference implementation's default docker-compose.yml publishes the amp-manager service's REST API directly to the host network interface (port 8089, e.g. \":8089/tcp\") with cap_add: NET_ADMIN, NET_RAW, SYS_NICE, bypassing the CAM (Configuration and Access Manager) gateway that is otherwise the system's sole authentication boundary.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-306"],"vendors":[],"products":[],"references":[{"url":"https://github.com/JHUAPL-DTNMA/dtnma-tools","tags":[]},{"url":"https://github.com/NASA-AMMOS/anms","tags":[]}],"exploitRefs":[{"url":"https://github.com/JHUAPL-DTNMA/dtnma-tools","tags":[]},{"url":"https://github.com/NASA-AMMOS/anms","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw allows direct access to the amp-manager REST API without going through the CAM gateway, enabling unauthorized access and potential full system compromise.","exploitability":"Exploitation is relatively straightforward given the direct network exposure, requiring only network access to the host interface.","blast_radius":"If exploited, the attacker could gain full control over the system, potentially leading to data theft, service disruption, or further propagation of the attack.","remediation":"Disable the amp-manager service or restrict its access to only the CAM gateway.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","web","api","network-exposure"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-09-28T08:59:56.607Z"}}