CVE-2026-71214
The Aerie/PlanDev sequencing-server's authorization middleware (sequencing-server/src/app.ts) derives the caller's Hasura session role via getHasuraSession, which prefers a session_variables object taken directly from the client-supplied JSON request body over the Authorization header's JWT claims, with no verification that the request actually originated from Hasura.
Published:Aug 5, 2026
Last Modified:Aug 10, 2026
EPS:Aug 5, 2026
EPSS Score:0.00336
CVSS Score:9.8
Affected Products
Vendor
Product
Action
Vendor
Nasa-ammos
Product
Plandev (sequencing-server)
Nasa-ammos
Plandev (sequencing-server)
Exploits
No exploit reference
Common Weakness Enumeration
Common Attack Pattern Enumeration and Classification (CAPEC)
References
Common Vulnerability Scoring System
Attack Vector
Network
Adjacent
Local
Physical
Privileges Required
None
Low
High
User Interaction
None
Required
Scope
Unchanged
Changed
Confidentiality
None
Low
High
Integrity
None
Low
High
Availability
None
Low
High
