The NASA‑AMMOS Asynchronous Network Management System reference implementation’s default docker‑compose configuration exposes the amp‑manager service’s REST API directly to the host network on port 8089 with elevated capabilities such as NET_ADMIN, NET_RAW, and SYS_NICE. This bypasses the Configuration and Access Manager gateway, the system’s sole authentication boundary, allowing any client that can reach port 8089 to send command requests without authentication and execute arbitrary command sets against connected DTNMA agents. The vulnerability is classified as CWE‑306, improper authorization, and the impact is full remote command execution that can compromise the confidentiality, integrity, and availability of managed nodes.

The affected component is the reference implementation of NASA‑AMMOS ANMS. The default docker‑compose configuration exposes the amp‑manager service to the host network on port 8089. No specific product or library versions are listed in the advisory; the issue exists in the shipped reference implementation.

The CVSS score of 9.8 classifies this as a critical vulnerability. The EPSS score of 0.00369 (less than 1%) indicates a very low exploitation probability at present, and the vulnerability is not listed in the CISA KEV catalog, though lack of public exploits does not diminish its severity. Attackers can exploit the exposed REST API from any host that can reach port 8089, bypassing the single authentication boundary that normally protects the system. Because no authentication is required, the attacker can control any registered agent, potentially influencing the operation of ground or spacecraft nodes. The risk is amplified in environments where the amp‑manager service is reachable from the broader network or the Internet, making exploitation more probable under those conditions.