CVE-2026-71214
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
In Aerie/PlanDev sequencing-server, the authorization middleware (sequencing-server/src/app.ts) derives the caller's Hasura session role via getHasuraSession, which prefers a session_variables object taken directly from the client-supplied JSON request body over the Authorization header's JWT claims, with no verification that the request actually originated from Hasura.
Risk Assessment
An attacker can impersonate a Hasura session and gain unauthorized privileges, potentially leading to access control breaches and exposure of sensitive data.
Recommendation
Verify the origin of the request (e.g., by validating JWT signature or trusted header) and do not trust client-supplied session_variables. Also, enforce that the session role comes only from authenticated sources.
Original NVD description (English source)
The Aerie/PlanDev sequencing-server's authorization middleware (sequencing-server/src/app.ts) derives the caller's Hasura session role via getHasuraSession, which prefers a session_variables object taken directly from the client-supplied JSON request body over the Authorization header's JWT claims, with no verification that the request actually originated from Hasura.