CVE-2026-44596: Yamcs missing rate limiting in authentication endpoint

CVE-2026-44596 · Severity: medium · CVSS 6.5 · Published 2026-07-16

Yamcs is a mission control framework used for space mission operations and telemetry. A security flaw in its login system allows attackers to make unlimited password guesses without being blocked or slowed down. This significantly increases the risk of unauthorized access to mission control accounts through brute-force attacks, potentially compromising sensitive mission data or operations.

Technologies: org.yamcs:yamcs-core (Maven), Yamcs. Vendors: Maven, Yamcs.

Quick answers

Is CVE-2026-44596 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-44596 being exploited in the wild.
How severe is CVE-2026-44596?
Medium severity, with a CVSS score of 6.5, published 16 July 2026.
Which products and versions are affected?
org.yamcs:yamcs-core (Maven) < 5.12.7, ECOSYSTEM:introduced=0,fixed=5.12.7; Yamcs < 5.12.7, < 5.12.7, < 5.13.0.
Is there a fix for CVE-2026-44596?
Yes. org.yamcs:yamcs-core (Maven): upgrade to 5.12.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44596 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-44596?
Check whether you run org.yamcs:yamcs-core (Maven) or Yamcs at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.yamcs:yamcs-core (Maven): upgrade to 5.12.7 or later
    # set org.yamcs:yamcs-core to 5.12.7 in your pom.xml or build.gradle

Technical details

The authentication endpoint 'POST /auth/token' in yamcs-core, specifically handled by AuthHandler.java, fails to implement rate limiting, account lockout, or failed-attempt throttling (CWE-307). An unauthenticated remote attacker can send a high volume of authentication requests to guess user passwords without triggering any defensive mechanisms like HTTP 429 (Too Many Requests) responses. This vulnerability allows for efficient automated brute-force attacks against any user account. The issue is resolved in versions 5.12.7 and 5.13.0 by implementing request throttling on the affected endpoint.

Affected products

  • Yamcs Yamcs < 5.12.7, < 5.13.0

Identifiers

  • CVE-2026-44596
  • GHSA-w5r6-mcgq-7pq4

Timeline

  • 2026-05-21: patched: Fixes released in versions 5.12.7 and 5.13.0
  • 2026-05-21: advisory: GitHub Security Advisory published
  • 2026-07-16: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.