Is CVE-2026-55521 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55521 being exploited in the wild.

How severe is CVE-2026-55521?

High severity, with a CVSS score of 8.8, published 28 August 2026.

Which products and versions are affected?

org.yamcs:yamcs-core (Maven) ECOSYSTEM:introduced=5.13.0,fixed=5.13.2.

Is there a fix for CVE-2026-55521?

Yes. org.yamcs:yamcs-core (Maven): upgrade to 5.13.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55521 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-55521?

Check whether you run org.yamcs:yamcs-core (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55521: Yamcs Core API missing authorization in multiple endpoints

CVE-2026-55521 · Severity: high · CVSS 8.8 · Published 2026-08-28

Yamcs is a satellite mission control system that manages telemetry data and command protocols. Three REST API endpoints fail to validate user permissions, allowing any authenticated user (even unprivileged "Guest" accounts) to read sensitive telemetry metadata, disable critical satellite communication protocols, and manipulate simulation timing. This bypasses role-based access controls that are correctly enforced elsewhere in the system.

Technologies: org.yamcs:yamcs-core (Maven). Vendors: Maven.

Quick answers

Is CVE-2026-55521 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55521 being exploited in the wild.
How severe is CVE-2026-55521?: High severity, with a CVSS score of 8.8, published 28 August 2026.
Which products and versions are affected?: org.yamcs:yamcs-core (Maven) ECOSYSTEM:introduced=5.13.0,fixed=5.13.2.
Is there a fix for CVE-2026-55521?: Yes. org.yamcs:yamcs-core (Maven): upgrade to 5.13.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55521 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-55521?: Check whether you run org.yamcs:yamcs-core (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

org.yamcs:yamcs-core (Maven): upgrade to 5.13.2 or later

# set org.yamcs:yamcs-core to 5.13.2 in your pom.xml or build.gradle

Technical details

Three API controllers in Yamcs Core fail to enforce authorization checks before executing sensitive operations: (1) IndexesApi methods (listPacketIndex, listEventIndex) return archived telemetry packet and event metadata without verifying ObjectPrivilege.ReadPacket; (2) Cop1Api endpoints (disable, resume, initialize, updateConfig) modify the COP-1 telecommand protocol state without checking SystemPrivilege.ControlLinks; (3) TimeApi.setTime modifies global SimulationTimeService without asserting any system privileges. The vulnerability requires valid credentials (authentication is enforced), but role-based authorization checks are completely absent from these three controllers, whereas other API controllers like PacketsApi correctly implement privilege verification. Authenticated attackers can enumerate metadata, disrupt satellite command transmission, or disrupt automated testing and processor operations for all users in the instance. Patches are available in versions 5.12.8 and 5.13.2.

Affected products

Yamcs Yamcs Core 5.12.0–5.12.7, 5.13.0–5.13.1

Identifiers

CVE-2026-55521
GHSA-962x-ccwf-8x6p

Timeline

2026-07-14: disclosed
2026-08-28: advisory
2026: patched: Versions 5.12.8 and 5.13.2 contain fixes

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.