Executive brief
Yamcs is a satellite mission control system that manages telemetry data and command protocols. Three REST API endpoints fail to validate user permissions, allowing any authenticated user (even unprivileged "Guest" accounts) to read sensitive telemetry metadata, disable critical satellite communication protocols, and manipulate simulation timing. This bypasses role-based access controls that are correctly enforced elsewhere in the system.
Technical details
Three API controllers in Yamcs Core fail to enforce authorization checks before executing sensitive operations: (1) IndexesApi methods (listPacketIndex, listEventIndex) return archived telemetry packet and event metadata without verifying ObjectPrivilege.ReadPacket; (2) Cop1Api endpoints (disable, resume, initialize, updateConfig) modify the COP-1 telecommand protocol state without checking SystemPrivilege.ControlLinks; (3) TimeApi.setTime modifies global SimulationTimeService without asserting any system privileges. The vulnerability requires valid credentials (authentication is enforced), but role-based authorization checks are completely absent from these three controllers, whereas other API controllers like PacketsApi correctly implement privilege verification. Authenticated attackers can enumerate metadata, disrupt satellite command transmission, or disrupt automated testing and processor operations for all users in the instance. Patches are available in versions 5.12.8 and 5.13.2.
Affected products
- Yamcs Yamcs Core 5.12.0–5.12.7, 5.13.0–5.13.1
Timeline
- 2026-07-14: disclosed
- 2026-08-28: advisory
- 2026: patched: Versions 5.12.8 and 5.13.2 contain fixes