CVE-2026-71289
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
The NASA-AMMOS Asynchronous Network Management System (ANMS) reference implementation's default docker-compose.yml publishes the amp-manager service's REST API directly to the host network interface (port 8089) with cap_add: NET_ADMIN, NET_RAW, SYS_NICE, bypassing the CAM gateway that is otherwise the system's sole authentication boundary.
Risk Assessment
An attacker can gain direct access to the API without authentication, potentially leading to unauthorized system management, integrity compromise, or takeover.
Recommendation
Modify the docker-compose.yml configuration to not publish port 8089 on the host and use the CAM gateway. Also restrict cap_add privileges.
Original NVD description (English source)
The NASA-AMMOS Asynchronous Network Management System (ANMS) reference implementation's default docker-compose.yml publishes the amp-manager service's REST API directly to the host network interface (port 8089, e.g. ":8089/tcp") with cap_add: NET_ADMIN, NET_RAW, SYS_NICE, bypassing the CAM (Configuration and Access Manager) gateway that is otherwise the system's sole authentication boundary.