The Aerie/PlanDev sequencing-server's authorization middleware (sequencing-server/src/app.ts) derives the caller's Hasura session role via getHasuraSession(), w…

CVE-2026-71214 affects the NASA AMMOS Aerie/PlanDev sequencing-server, where the authorization middleware in sequencing-server/src/app.ts incorrectly derives the caller's Hasura session role by preferring client-supplied JSON body content over verified JWT claims. An unauthenticated attacker can inject a session_variables object with an elevated role (aerie_admin) directly in the request body to bypass authentication entirely. This allows arbitrary insertion of expansion rules into sequencing.expansion_rule, which control how spacecraft activities are translated into commands. A second vulnerability exists where the POST /put-dictionary endpoint is whitelisted and exempt from any authentication, permitting unauthenticated writes of command dictionaries. Together, these flaws expose critical spacecraft mission planning infrastructure to unauthorized manipulation. The vulnerabilities are particularly severe given the safety-critical nature of spacecraft command sequencing systems.