CVE-2026-71214

Name of the Vulnerable Software and Affected Versions Aerie/PlanDev sequencing-server (affected versions not specified)

Description The authorization middleware in sequencing-server/src/app.ts uses the getHasuraSession() function to determine the caller's session role. This function prioritizes the session variables object provided in the client's JSON request body over the JWT claims in the Authorization header, without verifying if the request originated from Hasura. An unauthenticated attacker can bypass role checks by including {"session variables":{"x-hasura-role":"aerie admin"}} in the request body to the 'POST /command-expansion/put-expansion' endpoint, allowing the insertion of arbitrary expansion rules into sequencing.expansion rule. Additionally, the 'POST /put-dictionary' endpoint is included in the ENDPOINTS WHITELIST and does not require authentication, enabling unauthenticated writes to command dictionaries.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.