https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 07:31:52 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-349626 EUVD-2026-349626 https://cve.radiocsirt.org/vuln/euvd-2026-349626 https://cve.radiocsirt.org/vuln/fkie_cve-2026-71214 <p>The Aerie/PlanDev sequencing-server&#39;s authorization middleware (sequencing-server/src/app.ts) derives the caller&#39;s Hasura session role via getHasuraSession, which prefers a session_variables object taken directly from the client-supplied JSON request body over the Authorization header&#39;s JWT claims, with no verification that the request actually originated from Hasura.</p> <p>The Aerie/PlanDev sequencing-server&#39;s authorization middleware (sequencing-server/src/app.ts) derives the caller&#39;s Hasura session role via getHasuraSession, which prefers a session_variables object taken directly from the client-supplied JSON request body over the Authorization header&#39;s JWT claims, with no verification that the request actually originated from Hasura.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-71214 https://cve.radiocsirt.org/vuln/ghsa-x4pc-pqfq-54j2 <p>The Aerie/PlanDev sequencing-server&#39;s authorization middleware (sequencing-server/src/app.ts) derives the caller&#39;s Hasura session role via getHasuraSession(), which prefers a session_variables object taken directly from the client-supplied JSON request body over the Authorization header&#39;s JWT claims, with no verification that the request actually originated from Hasura. By setting {&#34;session_variables&#34;:{&#34;x-hasura-role&#34;:&#34;aerie_admin&#34;}} in the body of a request to POST /command-expansion/put-expansion with no Authorization header, an unauthenticated attacker satisfies the role check and can insert arbitrary expansion rules into sequencing.expansion_rule, which govern how spacecraft activities are translated into commands. Separately, POST /put-dictionary is explicitly listed in the ENDPOINTS_WHITELIST and is exempt from any authentication, allowing unauthenticated writes of command dictionaries.</p> <p>The Aerie/PlanDev sequencing-server&#39;s authorization middleware (sequencing-server/src/app.ts) derives the caller&#39;s Hasura session role via getHasuraSession(), which prefers a session_variables object taken directly from the client-supplied JSON request body over the Authorization header&#39;s JWT claims, with no verification that the request actually originated from Hasura. By setting {&#34;session_variables&#34;:{&#34;x-hasura-role&#34;:&#34;aerie_admin&#34;}} in the body of a request to POST /command-expansion/put-expansion with no Authorization header, an unauthenticated attacker satisfies the role check and can insert arbitrary expansion rules into sequencing.expansion_rule, which govern how spacecraft activities are translated into commands. Separately, POST /put-dictionary is explicitly listed in the ENDPOINTS_WHITELIST and is exempt from any authentication, allowing unauthenticated writes of command dictionaries.</p> https://cve.radiocsirt.org/vuln/ghsa-x4pc-pqfq-54j2