CVE-2026-71289 Details
Description
The NASA-AMMOS Asynchronous Network Management System (ANMS) reference implementation's default docker-compose.yml publishes the amp-manager service's REST API directly to the host network interface (port 8089, e.g. ":8089/tcp") with cap_add: NET_ADMIN, NET_RAW, SYS_NICE, bypassing the CAM (Configuration and Access Manager) gateway that is otherwise the system's sole authentication boundary.
A vulnerability exists in the NASA-AMMOS Asynchronous Network Management System (ANMS) reference implementation. The default docker-compose.yml file exposes the amp-manager service's REST API directly to the host network on port 8089. This exposure includes capabilities that bypass the system's sole authentication gateway, the Configuration and Access Manager (CAM). The REST server, built with CivetWeb, is configured to disable authentication checks and allows any network-accessible client to interact with registered DTNMA agents without credentials. This vulnerability affects both the NASA-AMMOS/anms and JHUAPL-DTNMA/dtnma-tools repositories, which are intended as a reference implementation and testbed for DTN network management.
No specific remediation is mentioned in the context. However, users can manually update the docker-compose.yml file to secure the amp-manager service's REST API by adding authentication or restricting access.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 5, 2026CISA-ADP
Assessed Aug 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/JHUAPL-DTNMA/dtnma-tools | TuranSec | Source CodeVendor |
| https://github.com/NASA-AMMOS/anms | TuranSec | Source CodeVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | TuranSec |
Affected Products
| Product | Versions |
|---|---|
| NASA-AMMOS ANMS | All versions |
CPE
Remediation
| |
| JHUAPL-DTNMA dtnma-tools | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 10, 2026 | CVE Modified | TuranSec |
| Aug 5, 2026 | CVE Modified | CISA-ADP |
| Aug 5, 2026 | New CVE Received | TuranSec |