What’s Vulnerable › Vulnerabilities

CVE-2026-55521: Yamcs : Multiple Missing Function Level Access Control vulnerabilities in Yamcs Core API

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-28 · updated 2026-09-08
• Weakness: CWE-862

Description

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits authorization checks in IndexesApi.listPacketIndex, IndexesApi.listEventIndex, Cop1Api.disable, Cop1Api.resume, Cop1Api.initialize, Cop1Api.updateConfig, and TimeApi.setTime. An authenticated low-privilege user can read packet and event index metadata without ObjectPrivilegeType.ReadPacket, alter COP-1 link state without SystemPrivilege.ControlLinks, and manipulate simulation time. These operations can disclose telemetry metadata, disrupt telecommand handling, and affect system integrity and availability. This issue is fixed in versions 5.12.8 and 5.13.2.

Affected products

• yamcs: before 5.12.8; from 5.13.0, < 5.13.2

References

• https://github.com/yamcs/yamcs/commit/405139afa6094dfaf63ac17f32df1f808846c950
• https://github.com/yamcs/yamcs/commit/493563679f838b86f3cdc5da9451d4a050ff6bd9
• https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.8
• https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.2
• https://github.com/yamcs/yamcs/security/advisories/GHSA-962x-ccwf-8x6p
• https://github.com/yamcs/yamcs/security/advisories/GHSA-962x-ccwf-8x6p

Get alerted when CVE-2026-55521 or the next vulnerability affects your stack