CVE-2026-71214 — NASA-AMMOS plandev - Client-Supplied session_variables Bypass Hasura-Origin Authorization in sequencing-server

CVE-2026-71214

NASA-AMMOS plandev - Client-Supplied session_variables Bypass Hasura-Origin Authorization in sequencing-server PUBLISHED

Description (CNA)

The Aerie/PlanDev sequencing-server's authorization middleware (sequencing-server/src/app.ts) derives the caller's Hasura session role via getHasuraSession, which prefers a session_variables object taken directly from the client-supplied JSON request body over the Authorization header's JWT claims, with no verification that the request actually originated from Hasura.

Affected (CNA)

Vendor / product	Versions
NASA-AMMOS / plandev (sequencing-server)	affected 0

CWE

CWE-306

References

https://github.com/NASA-AMMOS/plandev

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.