Critical severity9.8NVD Advisory· Published Aug 5, 2026· Updated Aug 26, 2026
CVE-2026-71214
CVE-2026-71214
Description
The Aerie/PlanDev sequencing-server's authorization middleware (sequencing-server/src/app.ts) derives the caller's Hasura session role via getHasuraSession, which prefers a session_variables object taken directly from the client-supplied JSON request body over the Authorization header's JWT claims, with no verification that the request actually originated from Hasura.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
News mentions
1- NASA AIT-GUI Flaws Could Let Unauthenticated Attackers Issue Spacecraft CommandsThe Hacker News · Aug 20, 2026