CVE-2026-71289

9.8 CRITICALpublic exploit available

Published 2026-08-05 · Updated 2026-08-10

AI risk analysis

Summary: The flaw allows direct access to the amp-manager REST API without going through the CAM gateway, enabling unauthorized access and potential full system compromise.
Exploitability: Exploitation is relatively straightforward given the direct network exposure, requiring only network access to the host interface.
Blast radius: If exploited, the attacker could gain full control over the system, potentially leading to data theft, service disruption, or further propagation of the attack.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Disable the amp-manager service or restrict its access to only the CAM gateway.

auth-bypasswebapinetwork-exposure

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

The NASA-AMMOS Asynchronous Network Management System (ANMS) reference implementation's default docker-compose.yml publishes the amp-manager service's REST API directly to the host network interface (port 8089, e.g. ":8089/tcp") with cap_add: NET_ADMIN, NET_RAW, SYS_NICE, bypassing the CAM (Configuration and Access Manager) gateway that is otherwise the system's sole authentication boundary.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-306

Public exploit & PoC references

References

Data: NVD (public domain). Analysis: local $0 model. Defensive use only.