# CVE-2026-44596: Yamcs missing rate limiting in authentication endpoint

Source: https://junglewise.ai/threats/cve-2026-44596-yamcs-missing-rate-limiting-in-authentication-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-16. Updated: 2026-07-16  
License: CC BY 4.0 with a link back

CVE-2026-44596 · Severity: medium · CVSS 6.5 · Published 2026-07-16

Yamcs is a mission control framework used for space mission operations and telemetry. A security flaw in its login system allows attackers to make unlimited password guesses without being blocked or slowed down. This significantly increases the risk of unauthorized access to mission control accounts through brute-force attacks, potentially compromising sensitive mission data or operations.

Technologies: [org.yamcs:yamcs-core (Maven)](https://junglewise.ai/threats/technologies/org-yamcs-yamcs-core), [Yamcs](https://junglewise.ai/threats/technologies/yamcs). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [Yamcs](https://junglewise.ai/threats/vendors/yamcs).

## Quick answers

**Is CVE-2026-44596 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44596 being exploited in the wild.

**How severe is CVE-2026-44596?** Medium severity, with a CVSS score of 6.5, published 16 July 2026.

**Which products and versions are affected?** org.yamcs:yamcs-core (Maven) < 5.12.7, ECOSYSTEM:introduced=0,fixed=5.12.7; Yamcs < 5.12.7, < 5.12.7, < 5.13.0.

**Is there a fix for CVE-2026-44596?** Yes. org.yamcs:yamcs-core (Maven): upgrade to 5.12.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44596 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-44596?** Check whether you run org.yamcs:yamcs-core (Maven) or Yamcs at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.yamcs:yamcs-core (Maven): upgrade to 5.12.7 or later

  ```sh
  # set org.yamcs:yamcs-core to 5.12.7 in your pom.xml or build.gradle
  ```


## Technical details

The authentication endpoint 'POST /auth/token' in yamcs-core, specifically handled by AuthHandler.java, fails to implement rate limiting, account lockout, or failed-attempt throttling (CWE-307). An unauthenticated remote attacker can send a high volume of authentication requests to guess user passwords without triggering any defensive mechanisms like HTTP 429 (Too Many Requests) responses. This vulnerability allows for efficient automated brute-force attacks against any user account. The issue is resolved in versions 5.12.7 and 5.13.0 by implementing request throttling on the affected endpoint.

## Affected products

- Yamcs Yamcs < 5.12.7, < 5.13.0

## Identifiers

- CVE-2026-44596
- GHSA-w5r6-mcgq-7pq4

## Timeline

- 2026-05-21: patched: Fixes released in versions 5.12.7 and 5.13.0
- 2026-05-21: advisory: GitHub Security Advisory published
- 2026-07-16: disclosed: CVE published to NVD

## References

- [https://github.com/yamcs/yamcs/commit/309218c651680f79df11a8d0f8628f7033f98a83](https://github.com/yamcs/yamcs/commit/309218c651680f79df11a8d0f8628f7033f98a83)
- [https://github.com/yamcs/yamcs/commit/64392df531fbcbc65f19ee5724c4c23d289f49fc](https://github.com/yamcs/yamcs/commit/64392df531fbcbc65f19ee5724c4c23d289f49fc)
- [https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7](https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7)
- [https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0](https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0)
- [https://github.com/yamcs/yamcs/security/advisories/GHSA-w5r6-mcgq-7pq4](https://github.com/yamcs/yamcs/security/advisories/GHSA-w5r6-mcgq-7pq4)

## Related threats

- [Yamcs DOM XSS in Extension Routing](https://junglewise.ai/threats/cve-2026-55566-yamcs-dom-xss-in-extension-routing)
- [Yamcs remote code execution via unescaped StreamSQL LIKE pattern](https://junglewise.ai/threats/cve-2026-55565-yamcs-remote-code-execution-via-unescaped-streamsql-like-pattern)
- [Yamcs remote code execution via YAML injection in instance template](https://junglewise.ai/threats/cve-2026-55559-yamcs-remote-code-execution-via-yaml-injection-in-instance)
- [Yamcs unauthenticated directory traversal](https://junglewise.ai/threats/cve-2026-55552-yamcs-unauthenticated-directory-traversal)
- [Yamcs reflected XSS in authorize endpoint](https://junglewise.ai/threats/cve-2026-55549-yamcs-reflected-xss-in-authorize-endpoint)