# CVE-2026-55521: Yamcs Core API missing authorization in multiple endpoints

Source: https://junglewise.ai/threats/cve-2026-55521-yamcs-core-api-missing-authorization-in-multiple-endpoints  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-28. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-55521 · Severity: high · CVSS 8.8 · Published 2026-08-28

Yamcs is a satellite mission control system that manages telemetry data and command protocols. Three REST API endpoints fail to validate user permissions, allowing any authenticated user (even unprivileged "Guest" accounts) to read sensitive telemetry metadata, disable critical satellite communication protocols, and manipulate simulation timing. This bypasses role-based access controls that are correctly enforced elsewhere in the system.

Technologies: [org.yamcs:yamcs-core (Maven)](https://junglewise.ai/threats/technologies/org-yamcs-yamcs-core). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-55521 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55521 being exploited in the wild.

**How severe is CVE-2026-55521?** High severity, with a CVSS score of 8.8, published 28 August 2026.

**Which products and versions are affected?** org.yamcs:yamcs-core (Maven) ECOSYSTEM:introduced=5.13.0,fixed=5.13.2.

**Is there a fix for CVE-2026-55521?** Yes. org.yamcs:yamcs-core (Maven): upgrade to 5.13.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55521 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-55521?** Check whether you run org.yamcs:yamcs-core (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.yamcs:yamcs-core (Maven): upgrade to 5.13.2 or later

  ```sh
  # set org.yamcs:yamcs-core to 5.13.2 in your pom.xml or build.gradle
  ```


## Technical details

Three API controllers in Yamcs Core fail to enforce authorization checks before executing sensitive operations: (1) IndexesApi methods (listPacketIndex, listEventIndex) return archived telemetry packet and event metadata without verifying ObjectPrivilege.ReadPacket; (2) Cop1Api endpoints (disable, resume, initialize, updateConfig) modify the COP-1 telecommand protocol state without checking SystemPrivilege.ControlLinks; (3) TimeApi.setTime modifies global SimulationTimeService without asserting any system privileges. The vulnerability requires valid credentials (authentication is enforced), but role-based authorization checks are completely absent from these three controllers, whereas other API controllers like PacketsApi correctly implement privilege verification. Authenticated attackers can enumerate metadata, disrupt satellite command transmission, or disrupt automated testing and processor operations for all users in the instance. Patches are available in versions 5.12.8 and 5.13.2.

## Affected products

- Yamcs Yamcs Core 5.12.0–5.12.7, 5.13.0–5.13.1

## Identifiers

- CVE-2026-55521
- GHSA-962x-ccwf-8x6p

## Timeline

- 2026-07-14: disclosed
- 2026-08-28: advisory
- 2026: patched: Versions 5.12.8 and 5.13.2 contain fixes

## References

- [https://api.github.com/users/lucquach](https://api.github.com/users/lucquach)
- [https://github.com/lucquach](https://github.com/lucquach)
- [https://api.github.com/users/lucquach/gists%7B/gist_id%7D](https://api.github.com/users/lucquach/gists%7B/gist_id%7D)
- [https://api.github.com/users/lucquach/repos](https://api.github.com/users/lucquach/repos)
- [https://avatars.githubusercontent.com/u/89955380?v=4](https://avatars.githubusercontent.com/u/89955380?v=4)
- [https://api.github.com/users/lucquach/events%7B/privacy%7D](https://api.github.com/users/lucquach/events%7B/privacy%7D)

## Related threats

- [Yamcs DOM XSS in Extension Routing](https://junglewise.ai/threats/cve-2026-55566-yamcs-dom-xss-in-extension-routing)
- [Yamcs remote code execution via unescaped StreamSQL LIKE pattern](https://junglewise.ai/threats/cve-2026-55565-yamcs-remote-code-execution-via-unescaped-streamsql-like-pattern)
- [Yamcs remote code execution via YAML injection in instance template](https://junglewise.ai/threats/cve-2026-55559-yamcs-remote-code-execution-via-yaml-injection-in-instance)
- [Yamcs unauthenticated directory traversal](https://junglewise.ai/threats/cve-2026-55552-yamcs-unauthenticated-directory-traversal)
- [Yamcs reflected XSS in authorize endpoint](https://junglewise.ai/threats/cve-2026-55549-yamcs-reflected-xss-in-authorize-endpoint)