Executive brief
Yamcs is a mission control framework used for space missions and satellite operations. A security flaw in its login system allows an attacker with a valid password to log in as a different user by using special characters in the username field. This could lead to unauthorized access to sensitive mission data or account takeover.
Technical details
An LDAP injection vulnerability exists in `org.yamcs.security.LdapAuthModule` due to improper neutralization of the username parameter before it is inserted into an LDAP search filter. Specifically, the code fails to apply RFC 4515 escaping, allowing characters like wildcards (*) to be processed by the LDAP server. An attacker with a known valid password can use a wildcard username (e.g., '*') to authenticate as the first user returned by the LDAP directory, leading to horizontal privilege escalation. This issue is reachable over the network via the authentication endpoint and has been patched in versions 5.12.7 and 5.13.0.
Affected products
- Yamcs Yamcs < 5.12.7, < 5.13.0
Timeline
- 2026-05-21: patched: Versions 5.12.7 and 5.13.0 released
- 2026-06-10: disclosed: CVE-2026-42568 published