NASA Ammos Plandev (Sequencing Server) vulnerabilities

1 vulnerability

Known vulnerabilities in NASA Ammos Plandev (Sequencing Server), newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

9.8CVE-2026-71214nasa-ammosplandev (sequencing-server)
EPSS score
0.48%
The Aerie/PlanDev sequencing-server's authorization middleware (sequencing-server/src/app.ts) derives the caller's Hasura session role via getHasuraSession, which prefers a session_variables object taken directly from the client-supplied JSON request body over the Authorization header's JWT claims, with no verification that the request actually originated from Hasura.