CVE-2026-71289 in ANMS
Summary
by MITRE • 08/05/2026
The NASA-AMMOS Asynchronous Network Management System (ANMS) reference implementation's default docker-compose.yml publishes the amp-manager service's REST API directly to the host network interface (port 8089, e.g. "${ION_MGR_PORT:-8089}:8089/tcp") with cap_add: NET_ADMIN, NET_RAW, SYS_NICE, bypassing the CAM (Configuration and Access Manager) gateway that is otherwise the system's sole authentication boundary. The underlying REST server, implemented with CivetWeb in JHUAPL/dtnma-tools (src/refdm/nm_rest.c), is configured with enable_auth_domain_check set to "no" and registers every route, including the DTNMA agent command-dispatch endpoints (.../agents/{eid|idx}/send, which accept and forward EXECSET-encoded command sets to a registered DTNMA agent), with a null authentication callback. Any network-reachable client can therefore enumerate registered agents, submit arbitrary command sets to them, and clear stored reports, entirely without credentials. This affects NASA-AMMOS/anms and JHUAPL-DTNMA/dtnma-tools as published; both repositories present this as a reference/ground DTN network-management implementation and testbed, and the affected components communicate with DTNMA agents (which may represent simulated or real spacecraft/ground nodes depending on deployment) rather than being flight software running onboard a spacecraft.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/05/2026
The vulnerability in the NASA-AMMOS Asynchronous Network Management System represents a critical security flaw that undermines the fundamental access control mechanisms designed to protect distributed network management operations. This issue stems from the default docker-compose.yml configuration that exposes the amp-manager service's REST API directly to the host network interface without proper authentication boundaries, creating an unauthenticated attack surface that bypasses the intended Configuration and Access Manager gateway. The exposure occurs through port 8089 with elevated privileges including NET_ADMIN, NET_RAW, and SYS_NICE capabilities, which significantly amplifies the potential impact of exploitation beyond simple unauthorized access.
The technical implementation details reveal a deeply flawed authentication architecture within the underlying CivetWeb server that operates through JHUAPL/dtnma-tools repository. The REST server configuration explicitly disables authentication domain checks with enable_auth_domain_check set to "no" and registers all endpoints with null authentication callbacks, effectively eliminating any form of access control for critical network management functions. This configuration directly violates security best practices outlined in CWE-306 (Missing Authentication) and CWE-287 (Improper Handling of Authentication), creating a scenario where any network-reachable client can execute arbitrary commands against registered DTNMA agents.
The operational impact of this vulnerability extends beyond simple unauthorized access to encompass complete compromise of the network management infrastructure. Attackers can enumerate registered agents, submit arbitrary command sets that are forwarded to registered DTNMA agents, and clear stored reports without authentication credentials. This capability represents a significant threat to the integrity and availability of the entire network management system, particularly since these agents may represent either simulated or real spacecraft/ground nodes depending on deployment context. The vulnerability affects both NASA-AMMOS/anms and JHUAPL-DTNMA/dtnma-tools repositories, which are presented as reference implementations and testbeds rather than flight software, yet still pose substantial risks to operational security.
The security implications align with ATT&CK framework techniques such as T1078 (Valid Accounts) and T1566 (Phishing), though the vulnerability itself represents a more fundamental failure in access control implementation. The exposure of command-dispatch endpoints like .../agents/{eid|idx}/send enables attackers to execute arbitrary operations against DTNMA agents, potentially disrupting critical network communications or causing unintended behavior in spacecraft systems. This vulnerability directly impacts the security posture of the entire DTN network management ecosystem and represents a failure in the principle of least privilege enforcement that should be applied to all network management interfaces.
Mitigation strategies must address both immediate exposure remediation and long-term architectural improvements to prevent similar vulnerabilities from occurring in future deployments. The primary recommendation involves implementing proper authentication boundaries through the CAM gateway, removing direct host network exposure of the REST API, and configuring appropriate access controls within the CivetWeb server implementation. Additionally, organizations should enforce network segmentation policies that prevent unauthorized access to management interfaces and implement regular security assessments to identify similar configuration flaws in containerized environments. The use of privileged capabilities should be minimized and restricted to only those operations that absolutely require elevated permissions, aligning with defense-in-depth principles recommended by NIST SP 800-53 and ISO/IEC 27001 standards.