CVE-2026-44595: Yamcs yamcs-core missing authorization in IAM API endpoints

CVE-2026-44595 · Severity: medium · CVSS 4.3 · Published 2026-07-16

Yamcs is a mission control framework used for space missions and satellite operations. A security flaw in its identity management system allows any logged-in user, regardless of their permission level, to view a full list of all other users, their group memberships, and who has administrative (superuser) status. This information could be used by a malicious insider to identify and target high-privileged accounts for further attacks.

Technologies: org.yamcs:yamcs-core (Maven), Yamcs. Vendors: Maven, Yamcs.

Quick answers

Is CVE-2026-44595 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-44595 being exploited in the wild.
How severe is CVE-2026-44595?
Medium severity, with a CVSS score of 4.3, published 16 July 2026.
Which products and versions are affected?
org.yamcs:yamcs-core (Maven) < 5.12.7, ECOSYSTEM:introduced=0,fixed=5.12.7; Yamcs < 5.12.7, < 5.12.7, < 5.13.0.
Is there a fix for CVE-2026-44595?
Yes. org.yamcs:yamcs-core (Maven): upgrade to 5.12.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44595 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-44595?
Check whether you run org.yamcs:yamcs-core (Maven) or Yamcs at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.yamcs:yamcs-core (Maven): upgrade to 5.12.7 or later
    # set org.yamcs:yamcs-core to 5.12.7 in your pom.xml or build.gradle

Technical details

A missing authorization check (CWE-862) exists in the yamcs-core component within the IamApi.java file. Specifically, the listUsers, getUser, listGroups, and getGroup API endpoints fail to enforce the 'SystemPrivilege.ControlAccess' check. While some sensitive details were filtered, the core identity information remained exposed to any authenticated user regardless of their assigned privileges. An attacker with low-level access can leverage these endpoints via the network to map the system's user hierarchy and identify privileged targets. The issue is resolved by adding the appropriate privilege checks in versions 5.12.7 and 5.13.0.

Affected products

  • Yamcs yamcs-core < 5.12.7, < 5.13.0

Identifiers

  • CVE-2026-44595
  • GHSA-p2rj-mrmc-9w29

Timeline

  • 2026-05-21: patched: Fixes released in versions 5.12.7 and 5.13.0
  • 2026-07-16: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.