Yamcs : Multiple Missing Function Level Access Control vulnerabilities in Yamcs Core API
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-862.
Summary
Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits authorization checks in IndexesApi.listPacketIndex, IndexesApi.listEventIndex, Cop1Api.disable, Cop1Api.resume, Cop1Api.initialize, Cop1Api.updateConfig, and TimeApi.setTime. An authenticated low-privilege user can read packet and event index metadata without ObjectPrivilegeType.ReadPacket, alter COP-1 link state without SystemPrivilege.ControlLinks, and manipulate simulation time. These operations can disclose telemetry metadata, disrupt telecommand handling, and affect system integrity and availability. This issue is fixed in versions 5.12.8 and 5.13.2.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| yamcs | yamcs | before 5.12.8; 5.13.0 to before 5.13.2 | 5.12.8, 5.13.2 | Patch available | CNA |
| — | org.yamcs:yamcs-core (Maven) | 5.13.0 to before 5.13.2 | 5.13.2 | Patch available | GHSA-962x-ccwf-8x6p |
| — | org.yamcs:yamcs-core (Maven) | before 5.12.8 | 5.12.8 | Patch available | GHSA-962x-ccwf-8x6p |
- yamcs Vendoryamcs Affected before 5.12.8; 5.13.0 to before 5.13.2 Fixed in 5.12.8, 5.13.2 Patch available CNA
- org.yamcs:yamcs-core (Maven) Vendor— Affected 5.13.0 to before 5.13.2 Fixed in 5.13.2 Patch available GHSA-962x-ccwf-8x6p
- org.yamcs:yamcs-core (Maven) Vendor— Affected before 5.12.8 Fixed in 5.12.8 Patch available GHSA-962x-ccwf-8x6p
Remediation
- Fix · CNA yamcs (yamcs) Fixed in 5.12.8, 5.13.2
- Fix · GHSA-962x-ccwf-8x6p org.yamcs:yamcs-core (Maven) Fixed in 5.13.2 Advisory →
- Fix · GHSA-962x-ccwf-8x6p org.yamcs:yamcs-core (Maven) Fixed in 5.12.8 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-55521
- 2026-10-03 Alias added: GHSA-962x-ccwf-8x6p
References
Other 6
- https://github.com/yamcs/yamcs/security/advisories/GHSA-962x-ccwf-8x6p
- https://github.com/yamcs/yamcs/commit/405139afa6094dfaf63ac17f32df1f808846c950
- https://github.com/yamcs/yamcs/commit/493563679f838b86f3cdc5da9451d4a050ff6bd9
- https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.8
- https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.2
- https://github.com/yamcs/yamcs
More yamcs vulnerabilities
- TI-2026-40103 Yamcs: Remote Code Execution via instance-template argument YAML injection (createInstance) CVSS 3.1CRITICAL 9.8
- TI-2026-34240 Yamcs: Remote Code Execution via Mission Database algorithm override CVSS 3.1CRITICAL 9.8
- TI-2026-32507 Yamcs: No Rate Limiting on Authentication Endpoint CVSS 3.1CRITICAL 9.8
- TI-2026-40106 Yamcs: Authenticated remote code execution via unescaped StreamSQL `LIKE` pattern compiled by Janino (`LikeExpression`) CVSS 3.1CRITICAL 9.9
- TI-2026-40057 Yamcs: Authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql` CVSS 3.1CRITICAL 9.1
- TI-2026-34277 Yamcs: Authenticated Remote Code Execution (RCE) via Jython Algorithm Code Injection CVSS 3.1CRITICAL 9.1
Sources
- CVE-2026-55521 · CVE Program
- CVE-2026-55521 · NVD
- FIRST EPSS
- GHSA-962x-ccwf-8x6p · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences