{"id":"CVE-2026-71289","published":"2026-08-05T13:24:53.703","lastModified":"2026-08-10T12:17:31.643","description":"The NASA-AMMOS Asynchronous Network Management System (ANMS) reference implementation's default docker-compose.yml publishes the amp-manager service's REST API directly to the host network interface (port 8089, e.g. \":8089/tcp\") with cap_add: NET_ADMIN, NET_RAW, SYS_NICE, bypassing the CAM (Configuration and Access Manager) gateway that is otherwise the system's sole authentication boundary.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-306"],"vendors":[],"products":[],"references":[{"url":"https://github.com/JHUAPL-DTNMA/dtnma-tools","tags":[]},{"url":"https://github.com/NASA-AMMOS/anms","tags":[]}],"exploitRefs":[{"url":"https://github.com/JHUAPL-DTNMA/dtnma-tools","tags":[]},{"url":"https://github.com/NASA-AMMOS/anms","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw allows direct access to the amp-manager REST API without going through the CAM gateway, enabling unauthorized access and potential full system compromise.","exploitability":"Exploitation is relatively easy given default configurations; requires network access to the host interface where the service is exposed.","blast_radius":"If exploited, it could lead to complete system compromise, allowing attackers to execute arbitrary code with elevated privileges.","remediation":"Restrict API access by configuring proper network isolation and authentication mechanisms, or disable unnecessary public exposure of the amp-manager service.","tags":["auth-bypass","rce","api","docker"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-08-11T06:43:48.256Z"}}