CVE-2026-71214

creationtimestamp| type| source ---|---|--- 2026-08-05 07:30:25+00:00| seen| https://infosec.exchange/users/offseq/statuses/117041727081914237 2026-08-05 07:30:28+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mscyzgcese2v 2026-08-05 09:24:05+00:00| seen|...

CVE-2026-71214 NASA-AMMOS plandev - Client-Supplied session_variables Bypass Hasura-Origin Authorization in sequencing-server

The Aerie/PlanDev sequencing-server's authorization middleware sequencing-server/src/app.ts derives the caller's Hasura session role via getHasuraSession, which prefers a sessionvariables object taken directly from the client-supplied JSON request body over the Authorization header's JWT claims,...