Refine your search
16 vulnerabilities found for yamcs by yamcs
CVE-2026-55566 (GCVE-0-2026-55566)
Vulnerability from cvelistv5
Published
2026-08-28 17:31
Modified
2026-08-28 20:31
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Summary
Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs processes attacker-controlled data from the /ext URL route in yamcs-web/src/main/webapp/projects/webapp/src/app/core/routes/extension.matcher.ts, extension.component.ts, and app.component.ts without checking registered plugin IDs before DOM rendering through innerHTML. A crafted URL can execute JavaScript when opened by a user. The script can read data available to the Yamcs web application and perform actions in the user context. This issue is fixed in versions 5.12.8 and 5.13.2.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55566",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-28T20:30:29.994741Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T20:31:29.178Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-9272-wg2r-7xmx"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "yamcs",
"vendor": "yamcs",
"versions": [
{
"status": "affected",
"version": "\u003c 5.12.8"
},
{
"status": "affected",
"version": "\u003e= 5.13.0, \u003c 5.13.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs processes attacker-controlled data from the /ext URL route in yamcs-web/src/main/webapp/projects/webapp/src/app/core/routes/extension.matcher.ts, extension.component.ts, and app.component.ts without checking registered plugin IDs before DOM rendering through innerHTML. A crafted URL can execute JavaScript when opened by a user. The script can read data available to the Yamcs web application and perform actions in the user context. This issue is fixed in versions 5.12.8 and 5.13.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T17:31:39.197Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/yamcs/yamcs/security/advisories/GHSA-9272-wg2r-7xmx",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-9272-wg2r-7xmx"
},
{
"name": "https://github.com/yamcs/yamcs/commit/8e18e279d8ce761c21f4f67bbd06a1bff804d297",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/commit/8e18e279d8ce761c21f4f67bbd06a1bff804d297"
},
{
"name": "https://github.com/yamcs/yamcs/commit/ecf34a4e2ccbe085e6ceff0253595b24d5ecb4aa",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/commit/ecf34a4e2ccbe085e6ceff0253595b24d5ecb4aa"
},
{
"name": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.8"
},
{
"name": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.2"
}
],
"source": {
"advisory": "GHSA-9272-wg2r-7xmx",
"discovery": "UNKNOWN"
},
"title": "Yamcs: DOM XSS in Extension Routing"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55566",
"datePublished": "2026-08-28T17:31:39.197Z",
"dateReserved": "2026-06-16T23:11:20.214Z",
"dateUpdated": "2026-08-28T20:31:29.178Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55565 (GCVE-0-2026-55565)
Vulnerability from cvelistv5
Published
2026-08-28 17:29
Modified
2026-08-28 17:29
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Summary
Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs LikeExpression.fillCode_getValueReturn in yamcs-core/src/main/java/org/yamcs/yarch/streamsql/LikeExpression.java inserts an unescaped LIKE pattern into Java source compiled by Expression.getCompiledExpression through SimpleCompiler.cook instead of applying ValueExpression.escapeJavaString. The pattern can originate from POST /api/archive/{instance}:executeSql, POST /api/archive/{instance}:streamSql, POST /api/archive/{instance}/tables/{table}:readRows, GET /api/archive/{instance}/events, or activity searches, including paths available with ReadTables, ReadEvents, or ReadActivities. A quote in the pattern can inject Java that runs as the Yamcs server process. This issue is fixed in versions 5.12.8 and 5.13.2.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "yamcs",
"vendor": "yamcs",
"versions": [
{
"status": "affected",
"version": "\u003c 5.12.8"
},
{
"status": "affected",
"version": "\u003e= 5.13.0, \u003c 5.13.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs LikeExpression.fillCode_getValueReturn in yamcs-core/src/main/java/org/yamcs/yarch/streamsql/LikeExpression.java inserts an unescaped LIKE pattern into Java source compiled by Expression.getCompiledExpression through SimpleCompiler.cook instead of applying ValueExpression.escapeJavaString. The pattern can originate from POST /api/archive/{instance}:executeSql, POST /api/archive/{instance}:streamSql, POST /api/archive/{instance}/tables/{table}:readRows, GET /api/archive/{instance}/events, or activity searches, including paths available with ReadTables, ReadEvents, or ReadActivities. A quote in the pattern can inject Java that runs as the Yamcs server process. This issue is fixed in versions 5.12.8 and 5.13.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T17:29:56.768Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/yamcs/yamcs/security/advisories/GHSA-c64q-hj4j-375f",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-c64q-hj4j-375f"
},
{
"name": "https://github.com/yamcs/yamcs/commit/640e1598b7097b521692e89dd47a39b6cb1fc663",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/commit/640e1598b7097b521692e89dd47a39b6cb1fc663"
},
{
"name": "https://github.com/yamcs/yamcs/commit/a8fb4a0693fa62a6eb729b26016d1090dd8b289c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/commit/a8fb4a0693fa62a6eb729b26016d1090dd8b289c"
},
{
"name": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.8"
},
{
"name": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.2"
}
],
"source": {
"advisory": "GHSA-c64q-hj4j-375f",
"discovery": "UNKNOWN"
},
"title": "Yamcs: Authenticated remote code execution via unescaped StreamSQL `LIKE` pattern compiled by Janino (`LikeExpression`)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55565",
"datePublished": "2026-08-28T17:29:56.768Z",
"dateReserved": "2026-06-16T23:11:20.214Z",
"dateUpdated": "2026-08-28T17:29:56.768Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55559 (GCVE-0-2026-55559)
Vulnerability from cvelistv5
Published
2026-08-28 17:22
Modified
2026-08-28 19:58
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs inserts templateArgs from POST /api/instances and PATCH /api/instances/{instance} into YAML through VarStatement.append in yamcs-core/src/main/java/org/yamcs/templating/VarStatement.java without YAML-context escaping. The rendered configuration is parsed by YamcsServer.createInstance and loaded by YamcsServerInstance, allowing an attacker to inject a services entry for org.yamcs.ProcessRunner. Deployments without security.yaml expose the operation through the guest superuser, while secured deployments require SystemPrivilege.CreateInstances. Successful exploitation executes commands as the Yamcs service account. This issue is fixed in versions 5.12.8 and 5.13.2.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55559",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-28T19:57:53.907806Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T19:58:04.713Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-73mf-m39p-wpm9"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "yamcs",
"vendor": "yamcs",
"versions": [
{
"status": "affected",
"version": "\u003c 5.12.8"
},
{
"status": "affected",
"version": "\u003e= 5.13.0, \u003c 5.13.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs inserts templateArgs from POST /api/instances and PATCH /api/instances/{instance} into YAML through VarStatement.append in yamcs-core/src/main/java/org/yamcs/templating/VarStatement.java without YAML-context escaping. The rendered configuration is parsed by YamcsServer.createInstance and loaded by YamcsServerInstance, allowing an attacker to inject a services entry for org.yamcs.ProcessRunner. Deployments without security.yaml expose the operation through the guest superuser, while secured deployments require SystemPrivilege.CreateInstances. Successful exploitation executes commands as the Yamcs service account. This issue is fixed in versions 5.12.8 and 5.13.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-470",
"description": "CWE-470: Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1336",
"description": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T17:22:07.633Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/yamcs/yamcs/security/advisories/GHSA-73mf-m39p-wpm9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-73mf-m39p-wpm9"
},
{
"name": "https://github.com/yamcs/yamcs/commit/549f295cf8c5496a5e799d6bec2432ef976c82aa",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/commit/549f295cf8c5496a5e799d6bec2432ef976c82aa"
},
{
"name": "https://github.com/yamcs/yamcs/commit/7192da1c49bdf5ab1d72e579a47766a7c43e87c8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/commit/7192da1c49bdf5ab1d72e579a47766a7c43e87c8"
},
{
"name": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.8"
},
{
"name": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.2"
}
],
"source": {
"advisory": "GHSA-73mf-m39p-wpm9",
"discovery": "UNKNOWN"
},
"title": "Yamcs: Remote Code Execution via instance-template argument YAML injection (createInstance)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55559",
"datePublished": "2026-08-28T17:22:07.633Z",
"dateReserved": "2026-06-16T23:11:20.213Z",
"dateUpdated": "2026-08-28T19:58:04.713Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55552 (GCVE-0-2026-55552)
Vulnerability from cvelistv5
Published
2026-08-28 17:18
Modified
2026-08-28 17:19
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Summary
Yamcs is a mission control framework. Prior to 5.11.13, Yamcs StaticFileHandler.locateFile resolves an unauthenticated request path without using Path.normalize and Path.toAbsolutePath to confirm that the absolute path remains within the configured staticRoots. A path containing traversal segments can escape the intended web root and return an arbitrary readable host file. The flaw is in yamcs-core/src/main/java/org/yamcs/http/StaticFileHandler.java and can disclose sensitive operating-system and application data. This issue is fixed in version 5.11.13, and the 5.12 line is fixed from version 5.12.0.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "yamcs",
"vendor": "yamcs",
"versions": [
{
"status": "affected",
"version": "\u003c 5.12.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Yamcs is a mission control framework. Prior to 5.11.13, Yamcs StaticFileHandler.locateFile resolves an unauthenticated request path without using Path.normalize and Path.toAbsolutePath to confirm that the absolute path remains within the configured staticRoots. A path containing traversal segments can escape the intended web root and return an arbitrary readable host file. The flaw is in yamcs-core/src/main/java/org/yamcs/http/StaticFileHandler.java and can disclose sensitive operating-system and application data. This issue is fixed in version 5.11.13, and the 5.12 line is fixed from version 5.12.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T17:19:40.876Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/yamcs/yamcs/security/advisories/GHSA-9jg3-g3wh-w9pj",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-9jg3-g3wh-w9pj"
},
{
"name": "https://github.com/yamcs/yamcs/commit/c7dfd24e469ae1086c23e0fe04401cb1ce4260d4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/commit/c7dfd24e469ae1086c23e0fe04401cb1ce4260d4"
},
{
"name": "https://github.com/yamcs/yamcs/commit/f4bc588880c166849e983aa8f65b9c8107d06091",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/commit/f4bc588880c166849e983aa8f65b9c8107d06091"
},
{
"name": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.11.13",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.11.13"
},
{
"name": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.0"
}
],
"source": {
"advisory": "GHSA-9jg3-g3wh-w9pj",
"discovery": "UNKNOWN"
},
"title": "Yamcs: Unauthenticated Directory Traversal"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55552",
"datePublished": "2026-08-28T17:18:45.617Z",
"dateReserved": "2026-06-16T23:01:04.075Z",
"dateUpdated": "2026-08-28T17:19:40.876Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55549 (GCVE-0-2026-55549)
Vulnerability from cvelistv5
Published
2026-08-28 17:15
Modified
2026-08-28 17:15
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Summary
Yamcs is a mission control framework. Prior to 5.9.4, Yamcs reflects an attacker-controlled redirect_uri parameter from GET /auth/authorize into yamcs-core/src/main/resources/auth/templates/authorize.html without adequate HTML escaping by yamcs-core/src/main/java/org/yamcs/http/auth/AuthHandler.java and yamcs-core/src/main/java/org/yamcs/http/HandlerContext.java. A crafted authorization URL can execute JavaScript when opened by a Yamcs user. The script can access browser-held authentication material and transmit it to an attacker, enabling account compromise. This issue is fixed in version 5.9.4.
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "yamcs",
"vendor": "yamcs",
"versions": [
{
"status": "affected",
"version": "\u003c 5.9.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Yamcs is a mission control framework. Prior to 5.9.4, Yamcs reflects an attacker-controlled redirect_uri parameter from GET /auth/authorize into yamcs-core/src/main/resources/auth/templates/authorize.html without adequate HTML escaping by yamcs-core/src/main/java/org/yamcs/http/auth/AuthHandler.java and yamcs-core/src/main/java/org/yamcs/http/HandlerContext.java. A crafted authorization URL can execute JavaScript when opened by a Yamcs user. The script can access browser-held authentication material and transmit it to an attacker, enabling account compromise. This issue is fixed in version 5.9.4."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T17:15:52.840Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/yamcs/yamcs/security/advisories/GHSA-rxpg-wjf8-qv9c",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-rxpg-wjf8-qv9c"
},
{
"name": "https://github.com/yamcs/yamcs/commit/4d47d5cdcf5d92c2c5bbbc19feada422923332e3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/commit/4d47d5cdcf5d92c2c5bbbc19feada422923332e3"
},
{
"name": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.9.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.9.4"
}
],
"source": {
"advisory": "GHSA-rxpg-wjf8-qv9c",
"discovery": "UNKNOWN"
},
"title": "Yamcs: Reflected XSS in the URL of the Authorize Endpoint"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55549",
"datePublished": "2026-08-28T17:15:52.840Z",
"dateReserved": "2026-06-16T23:01:04.075Z",
"dateUpdated": "2026-08-28T17:15:52.840Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55547 (GCVE-0-2026-55547)
Vulnerability from cvelistv5
Published
2026-08-28 17:11
Modified
2026-08-28 20:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits SystemPrivilege.ControlAccess checks from IamApi.listRoles, IamApi.getRole, and IamApi.listPrivileges in yamcs-core/src/main/java/org/yamcs/http/api/IamApi.java. Any authenticated account can call GET /api/roles, GET /api/roles/{name}, and GET /api/privileges to enumerate available system privileges and configured role mappings. The disclosure reveals security configuration that can support targeted privilege-escalation attempts. This issue is fixed in versions 5.12.8 and 5.13.2.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55547",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-28T20:29:51.716854Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T20:30:11.670Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-cvw4-55pp-3hfq"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "yamcs",
"vendor": "yamcs",
"versions": [
{
"status": "affected",
"version": "\u003c 5.12.8"
},
{
"status": "affected",
"version": "\u003e= 5.13.0, \u003c 5.13.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits SystemPrivilege.ControlAccess checks from IamApi.listRoles, IamApi.getRole, and IamApi.listPrivileges in yamcs-core/src/main/java/org/yamcs/http/api/IamApi.java. Any authenticated account can call GET /api/roles, GET /api/roles/{name}, and GET /api/privileges to enumerate available system privileges and configured role mappings. The disclosure reveals security configuration that can support targeted privilege-escalation attempts. This issue is fixed in versions 5.12.8 and 5.13.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "CWE-285: Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T17:11:34.332Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/yamcs/yamcs/security/advisories/GHSA-cvw4-55pp-3hfq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-cvw4-55pp-3hfq"
},
{
"name": "https://github.com/yamcs/yamcs/commit/c2aec1c242e656e48b52c7f87deea88183bb592d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/commit/c2aec1c242e656e48b52c7f87deea88183bb592d"
},
{
"name": "https://github.com/yamcs/yamcs/commit/dcaec5f0b2f4231b8e313e94d79a937169c9e0ba",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/commit/dcaec5f0b2f4231b8e313e94d79a937169c9e0ba"
},
{
"name": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.8"
},
{
"name": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.2"
}
],
"source": {
"advisory": "GHSA-cvw4-55pp-3hfq",
"discovery": "UNKNOWN"
},
"title": "Yamcs: Missing Authorization on Role and Privilege Enumeration Endpoints Allows Any Authenticated User to Disclose Full Security Configuration"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55547",
"datePublished": "2026-08-28T17:11:34.332Z",
"dateReserved": "2026-06-16T23:01:04.075Z",
"dateUpdated": "2026-08-28T20:30:11.670Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55545 (GCVE-0-2026-55545)
Vulnerability from cvelistv5
Published
2026-08-28 17:09
Modified
2026-08-28 17:09
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-862 - Missing Authorization
Summary
Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs WebSocket subscription handlers fail to enforce the privileges required by equivalent REST endpoints. PacketsApi.subscribePackets exposes the packets WebSocket topic without ObjectPrivilegeType.ReadPacket, ProcessingApi.subscribeAlgorithmStatus exposes the algorithm-status WebSocket topic without ObjectPrivilegeType.ReadAlgorithm, and MdbOverrideApi.subscribeMdbChanges exposes the mdb-changes WebSocket topic without SystemPrivilege.GetMissionDatabase. A low-privilege authenticated user can receive telemetry packets, algorithm status, and mission database change information outside the assigned authorization scope. This issue is fixed in versions 5.12.8 and 5.13.2.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "yamcs",
"vendor": "yamcs",
"versions": [
{
"status": "affected",
"version": "\u003c 5.12.8"
},
{
"status": "affected",
"version": "\u003e= 5.13.0, \u003c 5.13.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs WebSocket subscription handlers fail to enforce the privileges required by equivalent REST endpoints. PacketsApi.subscribePackets exposes the packets WebSocket topic without ObjectPrivilegeType.ReadPacket, ProcessingApi.subscribeAlgorithmStatus exposes the algorithm-status WebSocket topic without ObjectPrivilegeType.ReadAlgorithm, and MdbOverrideApi.subscribeMdbChanges exposes the mdb-changes WebSocket topic without SystemPrivilege.GetMissionDatabase. A low-privilege authenticated user can receive telemetry packets, algorithm status, and mission database change information outside the assigned authorization scope. This issue is fixed in versions 5.12.8 and 5.13.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T17:09:53.114Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/yamcs/yamcs/security/advisories/GHSA-fwww-cp23-7f5g",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-fwww-cp23-7f5g"
},
{
"name": "https://github.com/yamcs/yamcs/commit/0691731846c5a0aca81b88fabbd2cd51d56fe076",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/commit/0691731846c5a0aca81b88fabbd2cd51d56fe076"
},
{
"name": "https://github.com/yamcs/yamcs/commit/12864af555e6ca4941b01c1f1217859cc0492ce0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/commit/12864af555e6ca4941b01c1f1217859cc0492ce0"
},
{
"name": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.8"
},
{
"name": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.2"
}
],
"source": {
"advisory": "GHSA-fwww-cp23-7f5g",
"discovery": "UNKNOWN"
},
"title": "Yamcs: WebSocket subscription handlers omit the privilege checks their REST siblings enforce"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55545",
"datePublished": "2026-08-28T17:09:53.114Z",
"dateReserved": "2026-06-16T23:01:04.075Z",
"dateUpdated": "2026-08-28T17:09:53.114Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55521 (GCVE-0-2026-55521)
Vulnerability from cvelistv5
Published
2026-08-28 17:08
Modified
2026-08-28 19:52
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-862 - Missing Authorization
Summary
Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits authorization checks in IndexesApi.listPacketIndex, IndexesApi.listEventIndex, Cop1Api.disable, Cop1Api.resume, Cop1Api.initialize, Cop1Api.updateConfig, and TimeApi.setTime. An authenticated low-privilege user can read packet and event index metadata without ObjectPrivilegeType.ReadPacket, alter COP-1 link state without SystemPrivilege.ControlLinks, and manipulate simulation time. These operations can disclose telemetry metadata, disrupt telecommand handling, and affect system integrity and availability. This issue is fixed in versions 5.12.8 and 5.13.2.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55521",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-28T19:52:23.818416Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T19:52:43.290Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-962x-ccwf-8x6p"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "yamcs",
"vendor": "yamcs",
"versions": [
{
"status": "affected",
"version": "\u003c 5.12.8"
},
{
"status": "affected",
"version": "\u003e= 5.13.0, \u003c 5.13.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits authorization checks in IndexesApi.listPacketIndex, IndexesApi.listEventIndex, Cop1Api.disable, Cop1Api.resume, Cop1Api.initialize, Cop1Api.updateConfig, and TimeApi.setTime. An authenticated low-privilege user can read packet and event index metadata without ObjectPrivilegeType.ReadPacket, alter COP-1 link state without SystemPrivilege.ControlLinks, and manipulate simulation time. These operations can disclose telemetry metadata, disrupt telecommand handling, and affect system integrity and availability. This issue is fixed in versions 5.12.8 and 5.13.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T17:08:16.725Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/yamcs/yamcs/security/advisories/GHSA-962x-ccwf-8x6p",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-962x-ccwf-8x6p"
},
{
"name": "https://github.com/yamcs/yamcs/commit/405139afa6094dfaf63ac17f32df1f808846c950",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/commit/405139afa6094dfaf63ac17f32df1f808846c950"
},
{
"name": "https://github.com/yamcs/yamcs/commit/493563679f838b86f3cdc5da9451d4a050ff6bd9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/commit/493563679f838b86f3cdc5da9451d4a050ff6bd9"
},
{
"name": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.8"
},
{
"name": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.2"
}
],
"source": {
"advisory": "GHSA-962x-ccwf-8x6p",
"discovery": "UNKNOWN"
},
"title": "Yamcs : Multiple Missing Function Level Access Control vulnerabilities in Yamcs Core API"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55521",
"datePublished": "2026-08-28T17:08:16.725Z",
"dateReserved": "2026-06-16T22:44:22.284Z",
"dateUpdated": "2026-08-28T19:52:43.290Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55511 (GCVE-0-2026-55511)
Vulnerability from cvelistv5
Published
2026-08-28 17:05
Modified
2026-08-28 17:05
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Summary
Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs allows a user with SystemPrivilege.ControlArchiving to create a double-quoted StreamSQL column name that is interpolated into generated Java source by Expression.fillCode_InputDefVars and Expression.sanitizeName. A sum aggregate reaches yamcs-core/src/main/java/org/yamcs/yarch/streamsql/CompilableAggregateExpression.java and yamcs-core/src/main/java/org/yamcs/yarch/streamsql/funct/SumExpression.java through SelectExpression.compile, where Janino SimpleCompiler.cook compiles the injected source. POST /api/archive/{instance}:executeSql can therefore execute arbitrary Java in the Yamcs server process, exposing mission data and credentials and permitting telemetry tampering or denial of service. This issue is fixed in versions 5.12.8 and 5.13.2.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "yamcs",
"vendor": "yamcs",
"versions": [
{
"status": "affected",
"version": "\u003c 5.12.8"
},
{
"status": "affected",
"version": "\u003e= 5.13.0, \u003c 5.13.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs allows a user with SystemPrivilege.ControlArchiving to create a double-quoted StreamSQL column name that is interpolated into generated Java source by Expression.fillCode_InputDefVars and Expression.sanitizeName. A sum aggregate reaches yamcs-core/src/main/java/org/yamcs/yarch/streamsql/CompilableAggregateExpression.java and yamcs-core/src/main/java/org/yamcs/yarch/streamsql/funct/SumExpression.java through SelectExpression.compile, where Janino SimpleCompiler.cook compiles the injected source. POST /api/archive/{instance}:executeSql can therefore execute arbitrary Java in the Yamcs server process, exposing mission data and credentials and permitting telemetry tampering or denial of service. This issue is fixed in versions 5.12.8 and 5.13.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T17:05:02.307Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/yamcs/yamcs/security/advisories/GHSA-3g44-3m7x-cgg2",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-3g44-3m7x-cgg2"
},
{
"name": "https://github.com/yamcs/yamcs/commit/8c1070b12c0a6c003903325cb2a1013347e2dbde",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/commit/8c1070b12c0a6c003903325cb2a1013347e2dbde"
},
{
"name": "https://github.com/yamcs/yamcs/commit/b65a3d78178ba99a58b753feda6ecc3b5a694f13",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/commit/b65a3d78178ba99a58b753feda6ecc3b5a694f13"
},
{
"name": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.8"
},
{
"name": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.2"
}
],
"source": {
"advisory": "GHSA-3g44-3m7x-cgg2",
"discovery": "UNKNOWN"
},
"title": "Yamcs: Authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql`"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55511",
"datePublished": "2026-08-28T17:05:02.307Z",
"dateReserved": "2026-06-16T22:44:22.283Z",
"dateUpdated": "2026-08-28T17:05:02.307Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55548 (GCVE-0-2026-55548)
Vulnerability from cvelistv5
Published
2026-07-16 16:09
Modified
2026-07-16 18:14
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, the PacketsApi.exportPackets endpoint in yamcs-core/src/main/java/org/yamcs/http/api/PacketsApi.java failed to enforce object-level ReadPacket privileges when a request omitted specific packet names: with an empty name list the ctx.checkObjectPrivileges(ObjectPrivilegeType.ReadPacket, nameSet) call passed over an empty set, no WHERE pname IN filter was applied to the resulting SELECT * FROM tm query, and the onTuple handler streamed every retrieved packet without any per-row authorization check, so a low-privileged or zero-privilege authenticated user could dump the entire raw telemetry packet archive and bypass the role-based access control model. This issue is fixed in versions 5.12.8 and 5.13.2, which enforce per-packet ReadPacket checks in exportPackets.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55548",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-16T18:13:25.756720Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-16T18:14:19.081Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-8xjq-pr36-ccgf"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "yamcs",
"vendor": "yamcs",
"versions": [
{
"status": "affected",
"version": "\u003c 5.12.8"
},
{
"status": "affected",
"version": "\u003e= 5.13.0, \u003c 5.13.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, the PacketsApi.exportPackets endpoint in yamcs-core/src/main/java/org/yamcs/http/api/PacketsApi.java failed to enforce object-level ReadPacket privileges when a request omitted specific packet names: with an empty name list the ctx.checkObjectPrivileges(ObjectPrivilegeType.ReadPacket, nameSet) call passed over an empty set, no WHERE pname IN filter was applied to the resulting SELECT * FROM tm query, and the onTuple handler streamed every retrieved packet without any per-row authorization check, so a low-privileged or zero-privilege authenticated user could dump the entire raw telemetry packet archive and bypass the role-based access control model. This issue is fixed in versions 5.12.8 and 5.13.2, which enforce per-packet ReadPacket checks in exportPackets."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284: Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-16T16:09:35.505Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/yamcs/yamcs/security/advisories/GHSA-8xjq-pr36-ccgf",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-8xjq-pr36-ccgf"
},
{
"name": "https://github.com/yamcs/yamcs/commit/b566beceba98cc35514b0e1519be126b8c5a0438",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/commit/b566beceba98cc35514b0e1519be126b8c5a0438"
},
{
"name": "https://github.com/yamcs/yamcs/commit/c743cc3acf5b5c53ff5181b94eacc21340f70dd9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/commit/c743cc3acf5b5c53ff5181b94eacc21340f70dd9"
},
{
"name": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.8"
},
{
"name": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.2"
}
],
"source": {
"advisory": "GHSA-8xjq-pr36-ccgf",
"discovery": "UNKNOWN"
},
"title": "Yamcs: Insecure Direct Object Reference (IDOR) in PacketsApi allows unprivileged users to dump all telemetry packets"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55548",
"datePublished": "2026-07-16T16:09:35.505Z",
"dateReserved": "2026-06-16T23:01:04.075Z",
"dateUpdated": "2026-07-16T18:14:19.081Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46621 (GCVE-0-2026-46621)
Vulnerability from cvelistv5
Published
2026-07-16 16:07
Modified
2026-07-16 18:00
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Summary
Yamcs is a mission control framework. Prior to 5.12.7, the Yamcs script evaluation engine for Python algorithms dynamically compiled and evaluated user-controlled algorithm text using Jython through the JSR-223 ScriptEngine API without enforcing a secure sandbox, so an authenticated user with the ChangeMissionDatabase privilege could override an existing Python algorithm's logic through the mission database REST API and import and execute arbitrary Java classes such as java.lang.Runtime to achieve remote code execution on the underlying host operating system. This issue is fixed in versions 5.12.7 and 5.13.0, which disable algorithm editing by default.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-46621",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-16T18:00:23.750726Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-16T18:00:50.323Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-2g95-6x5q-xjwj"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "yamcs",
"vendor": "yamcs",
"versions": [
{
"status": "affected",
"version": "\u003c 5.12.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Yamcs is a mission control framework. Prior to 5.12.7, the Yamcs script evaluation engine for Python algorithms dynamically compiled and evaluated user-controlled algorithm text using Jython through the JSR-223 ScriptEngine API without enforcing a secure sandbox, so an authenticated user with the ChangeMissionDatabase privilege could override an existing Python algorithm\u0027s logic through the mission database REST API and import and execute arbitrary Java classes such as java.lang.Runtime to achieve remote code execution on the underlying host operating system. This issue is fixed in versions 5.12.7 and 5.13.0, which disable algorithm editing by default."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-16T16:07:38.699Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/yamcs/yamcs/security/advisories/GHSA-2g95-6x5q-xjwj",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-2g95-6x5q-xjwj"
},
{
"name": "https://github.com/yamcs/yamcs/commit/3c550348f866af4675d2ba4a51d8d12b7c7c6011",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/commit/3c550348f866af4675d2ba4a51d8d12b7c7c6011"
},
{
"name": "https://github.com/yamcs/yamcs/commit/4ff8fda642ea8c3309a4d3f379aa77b763148992",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/commit/4ff8fda642ea8c3309a4d3f379aa77b763148992"
},
{
"name": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7"
},
{
"name": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0"
}
],
"source": {
"advisory": "GHSA-2g95-6x5q-xjwj",
"discovery": "UNKNOWN"
},
"title": "Yamcs: Authenticated Remote Code Execution (RCE) via Jython Algorithm Code Injection"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-46621",
"datePublished": "2026-07-16T16:07:38.699Z",
"dateReserved": "2026-05-15T19:34:14.012Z",
"dateUpdated": "2026-07-16T18:00:50.323Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46562 (GCVE-0-2026-46562)
Vulnerability from cvelistv5
Published
2026-07-16 16:06
Modified
2026-07-16 18:02
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
Yamcs is a mission control framework. Prior to 5.12.7, the Nashorn ScriptEngine used to evaluate user-supplied JavaScript algorithm text in yamcs-core/src/main/java/org/yamcs/algorithms/ScriptAlgorithmExecutorFactory.java was constructed without a ClassFilter, so a user with the ChangeMissionDatabase privilege could override an algorithm through the MdbOverrideApi.updateAlgorithm endpoint and supply JavaScript that reaches arbitrary Java classes (for example Java.type("java.lang.Runtime").getRuntime().exec(...)) to execute arbitrary OS commands as the Yamcs process; in the default configuration with no security.yaml the built-in guest user has superuser=true, making the issue reachable without authentication. This issue is fixed in versions 5.12.7 and 5.13.0, which disable algorithm editing by default.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-46562",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-16T18:01:46.175576Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-16T18:02:19.337Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-vmwp-vh32-rj75"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "yamcs",
"vendor": "yamcs",
"versions": [
{
"status": "affected",
"version": "\u003c 5.12.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Yamcs is a mission control framework. Prior to 5.12.7, the Nashorn ScriptEngine used to evaluate user-supplied JavaScript algorithm text in yamcs-core/src/main/java/org/yamcs/algorithms/ScriptAlgorithmExecutorFactory.java was constructed without a ClassFilter, so a user with the ChangeMissionDatabase privilege could override an algorithm through the MdbOverrideApi.updateAlgorithm endpoint and supply JavaScript that reaches arbitrary Java classes (for example Java.type(\"java.lang.Runtime\").getRuntime().exec(...)) to execute arbitrary OS commands as the Yamcs process; in the default configuration with no security.yaml the built-in guest user has superuser=true, making the issue reachable without authentication. This issue is fixed in versions 5.12.7 and 5.13.0, which disable algorithm editing by default."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-95",
"description": "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (\u0027Eval Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-470",
"description": "CWE-470: Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-16T16:06:39.148Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/yamcs/yamcs/security/advisories/GHSA-vmwp-vh32-rj75",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-vmwp-vh32-rj75"
},
{
"name": "https://github.com/yamcs/yamcs/commit/3c550348f866af4675d2ba4a51d8d12b7c7c6011",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/commit/3c550348f866af4675d2ba4a51d8d12b7c7c6011"
},
{
"name": "https://github.com/yamcs/yamcs/commit/4ff8fda642ea8c3309a4d3f379aa77b763148992",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/commit/4ff8fda642ea8c3309a4d3f379aa77b763148992"
},
{
"name": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7"
},
{
"name": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0"
}
],
"source": {
"advisory": "GHSA-vmwp-vh32-rj75",
"discovery": "UNKNOWN"
},
"title": "Yamcs: Remote Code Execution via Mission Database algorithm override"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-46562",
"datePublished": "2026-07-16T16:06:39.148Z",
"dateReserved": "2026-05-14T20:42:31.370Z",
"dateUpdated": "2026-07-16T18:02:19.337Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-44632 (GCVE-0-2026-44632)
Vulnerability from cvelistv5
Published
2026-07-16 16:05
Modified
2026-07-16 16:46
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Summary
Yamcs is a mission control framework. Prior to 5.12.7, a server-side code injection vulnerability existed in the Yamcs algorithm evaluation engine org.yamcs.algorithms.JavaExprAlgorithmExecutionFactory, which dynamically compiled and evaluated user-controlled algorithm text through the Janino compiler without enforcing a secure sandbox, so an authenticated user with the ChangeMissionDatabase privilege could override an existing algorithm's text via the mission database REST API and inject Java code (for example using java.lang.Runtime) to achieve remote code execution on the underlying host operating system. This issue is fixed in versions 5.12.7 and 5.13.0, which disable algorithm editing by default.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-44632",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-16T16:45:59.615647Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-16T16:46:26.159Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-524g-x36v-9wm6"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "yamcs",
"vendor": "yamcs",
"versions": [
{
"status": "affected",
"version": "\u003c 5.12.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Yamcs is a mission control framework. Prior to 5.12.7, a server-side code injection vulnerability existed in the Yamcs algorithm evaluation engine org.yamcs.algorithms.JavaExprAlgorithmExecutionFactory, which dynamically compiled and evaluated user-controlled algorithm text through the Janino compiler without enforcing a secure sandbox, so an authenticated user with the ChangeMissionDatabase privilege could override an existing algorithm\u0027s text via the mission database REST API and inject Java code (for example using java.lang.Runtime) to achieve remote code execution on the underlying host operating system. This issue is fixed in versions 5.12.7 and 5.13.0, which disable algorithm editing by default."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-16T16:05:28.554Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/yamcs/yamcs/security/advisories/GHSA-524g-x36v-9wm6",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-524g-x36v-9wm6"
},
{
"name": "https://github.com/yamcs/yamcs/commit/3c550348f866af4675d2ba4a51d8d12b7c7c6011",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/commit/3c550348f866af4675d2ba4a51d8d12b7c7c6011"
},
{
"name": "https://github.com/yamcs/yamcs/commit/4ff8fda642ea8c3309a4d3f379aa77b763148992",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/commit/4ff8fda642ea8c3309a4d3f379aa77b763148992"
},
{
"name": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7"
},
{
"name": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0"
}
],
"source": {
"advisory": "GHSA-524g-x36v-9wm6",
"discovery": "UNKNOWN"
},
"title": "Yamcs: Server-Side Code Injection (RCE) via Janino Expression Engine in `JavaExprAlgorithmExecutionFactory`"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-44632",
"datePublished": "2026-07-16T16:05:28.554Z",
"dateReserved": "2026-05-07T15:30:10.874Z",
"dateUpdated": "2026-07-16T16:46:26.159Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-44596 (GCVE-0-2026-44596)
Vulnerability from cvelistv5
Published
2026-07-16 16:04
Modified
2026-07-17 14:05
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-307 - Improper Restriction of Excessive Authentication Attempts
Summary
Yamcs is a mission control framework. Prior to 5.12.7, the authentication endpoint POST /auth/token in yamcs-core, handled by yamcs-core/src/main/java/org/yamcs/http/auth/AuthHandler.java, lacked any rate limiting, account lockout, or failed-attempt throttling, so an unauthenticated remote attacker could perform unlimited password-guessing attempts against any user account, significantly increasing the risk of successful brute-force attacks. This issue is fixed in versions 5.12.7 and 5.13.0.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-44596",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-17T14:05:04.998522Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-17T14:05:15.049Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-w5r6-mcgq-7pq4"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "yamcs",
"vendor": "yamcs",
"versions": [
{
"status": "affected",
"version": "\u003c 5.12.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Yamcs is a mission control framework. Prior to 5.12.7, the authentication endpoint POST /auth/token in yamcs-core, handled by yamcs-core/src/main/java/org/yamcs/http/auth/AuthHandler.java, lacked any rate limiting, account lockout, or failed-attempt throttling, so an unauthenticated remote attacker could perform unlimited password-guessing attempts against any user account, significantly increasing the risk of successful brute-force attacks. This issue is fixed in versions 5.12.7 and 5.13.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-307",
"description": "CWE-307: Improper Restriction of Excessive Authentication Attempts",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-16T16:04:11.794Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/yamcs/yamcs/security/advisories/GHSA-w5r6-mcgq-7pq4",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-w5r6-mcgq-7pq4"
},
{
"name": "https://github.com/yamcs/yamcs/commit/309218c651680f79df11a8d0f8628f7033f98a83",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/commit/309218c651680f79df11a8d0f8628f7033f98a83"
},
{
"name": "https://github.com/yamcs/yamcs/commit/64392df531fbcbc65f19ee5724c4c23d289f49fc",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/commit/64392df531fbcbc65f19ee5724c4c23d289f49fc"
},
{
"name": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7"
},
{
"name": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0"
}
],
"source": {
"advisory": "GHSA-w5r6-mcgq-7pq4",
"discovery": "UNKNOWN"
},
"title": "Yamcs: No Rate Limiting on Authentication Endpoint"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-44596",
"datePublished": "2026-07-16T16:04:11.794Z",
"dateReserved": "2026-05-06T21:49:12.426Z",
"dateUpdated": "2026-07-17T14:05:15.049Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-44595 (GCVE-0-2026-44595)
Vulnerability from cvelistv5
Published
2026-07-16 16:02
Modified
2026-07-18 02:57
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-862 - Missing Authorization
Summary
Yamcs is a mission control framework. Prior to 5.12.7, the IAM API endpoints listUsers, getUser, listGroups, and getGroup in yamcs-core did not enforce the required SystemPrivilege.ControlAccess check in yamcs-core/src/main/java/org/yamcs/http/api/IamApi.java, so any authenticated user, even one with low or no privileges, could enumerate all user accounts in the system including their usernames, superuser status, and group memberships. This issue is fixed in versions 5.12.7 and 5.13.0.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-44595",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-18T02:56:44.582521Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-18T02:57:18.980Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-p2rj-mrmc-9w29"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "yamcs",
"vendor": "yamcs",
"versions": [
{
"status": "affected",
"version": "\u003c 5.12.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Yamcs is a mission control framework. Prior to 5.12.7, the IAM API endpoints listUsers, getUser, listGroups, and getGroup in yamcs-core did not enforce the required SystemPrivilege.ControlAccess check in yamcs-core/src/main/java/org/yamcs/http/api/IamApi.java, so any authenticated user, even one with low or no privileges, could enumerate all user accounts in the system including their usernames, superuser status, and group memberships. This issue is fixed in versions 5.12.7 and 5.13.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-16T16:02:46.293Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/yamcs/yamcs/security/advisories/GHSA-p2rj-mrmc-9w29",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-p2rj-mrmc-9w29"
},
{
"name": "https://github.com/yamcs/yamcs/commit/0e12b518f103f24681299318a30a460fe4327b88",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/commit/0e12b518f103f24681299318a30a460fe4327b88"
},
{
"name": "https://github.com/yamcs/yamcs/commit/e90099fba98e96214217c195b6a5b87b5f46e51c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/commit/e90099fba98e96214217c195b6a5b87b5f46e51c"
},
{
"name": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7"
},
{
"name": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0"
}
],
"source": {
"advisory": "GHSA-p2rj-mrmc-9w29",
"discovery": "UNKNOWN"
},
"title": "Yamcs: Unauthorized user enumeration via IAM API endpoints"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-44595",
"datePublished": "2026-07-16T16:02:46.293Z",
"dateReserved": "2026-05-06T21:49:12.426Z",
"dateUpdated": "2026-07-18T02:57:18.980Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-42568 (GCVE-0-2026-42568)
Vulnerability from cvelistv5
Published
2026-06-10 22:15
Modified
2026-06-11 16:14
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-90 - Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
Summary
Yamcs is a mission control framework. Prior to versions 5.13.0 and 5.12.7, an LDAP injection vulnerability exists in `org.yamcs.security.LdapAuthModule` when constructing search filters. The username parameter is inserted directly into the LDAP filter without proper RFC 4515 escaping. Versions 5.13.0 and 5.12.7 patch the issue.
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-42568",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-11T14:47:09.450504Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-11T16:14:10.877Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "yamcs",
"vendor": "yamcs",
"versions": [
{
"status": "affected",
"version": "\u003c 5.12.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Yamcs is a mission control framework. Prior to versions 5.13.0 and 5.12.7, an LDAP injection vulnerability exists in `org.yamcs.security.LdapAuthModule` when constructing search filters. The username parameter is inserted directly into the LDAP filter without proper RFC 4515 escaping. Versions 5.13.0 and 5.12.7 patch the issue."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-90",
"description": "CWE-90: Improper Neutralization of Special Elements used in an LDAP Query (\u0027LDAP Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-10T22:15:52.087Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/yamcs/yamcs/security/advisories/GHSA-cqh3-jg8p-336j",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-cqh3-jg8p-336j"
},
{
"name": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7"
},
{
"name": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0"
}
],
"source": {
"advisory": "GHSA-cqh3-jg8p-336j",
"discovery": "UNKNOWN"
},
"title": "Yamcs Vulnerable to LDAP Injection in LdapAuthModule"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-42568",
"datePublished": "2026-06-10T22:15:52.087Z",
"dateReserved": "2026-04-28T17:26:12.084Z",
"dateUpdated": "2026-06-11T16:14:10.877Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}