# CVE-2026-55545: Yamcs WebSocket subscription handlers missing authorization checks

Source: https://junglewise.ai/threats/cve-2026-55545-yamcs-websocket-subscription-handlers-missing-authorization  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-28. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-55545 · Severity: medium · CVSS 6.5 · Published 2026-08-28

Yamcs is a space mission control software that manages telemetry and command operations. Three WebSocket subscription handlers omit permission checks that the REST API enforces, allowing authenticated users with restricted roles to subscribe and receive sensitive mission data they should not access—including raw binary telemetry packets, algorithm status updates, and database changes. This is a privilege escalation flaw that could expose confidential mission operations data to authorized but limited-role users.

Technologies: [org.yamcs:yamcs-core (Maven)](https://junglewise.ai/threats/technologies/org-yamcs-yamcs-core). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-55545 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55545 being exploited in the wild.

**How severe is CVE-2026-55545?** Medium severity, with a CVSS score of 6.5, published 28 August 2026.

**Which products and versions are affected?** org.yamcs:yamcs-core (Maven) ECOSYSTEM:introduced=0,fixed=5.12.8.

**Is there a fix for CVE-2026-55545?** Yes. org.yamcs:yamcs-core (Maven): upgrade to 5.12.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55545 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-55545?** Check whether you run org.yamcs:yamcs-core (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.yamcs:yamcs-core (Maven): upgrade to 5.12.8 or later

  ```sh
  # set org.yamcs:yamcs-core to 5.12.8 in your pom.xml or build.gradle
  ```


## Technical details

This vulnerability stems from missing authorization checks (CWE-862) in three WebSocket subscription handlers: PacketsApi.subscribePackets (missing ReadPacket check), ProcessingApi.subscribeAlgorithmStatus (missing ReadAlgorithm check), and MdbOverrideApi.subscribeMdbChanges (missing GetMissionDatabase check). The REST API endpoints enforce these checks via checkObjectPrivileges() and similar mechanisms, but the corresponding WebSocket handlers do not. An authenticated attacker (PR:L per CVSS) with a narrow role can subscribe over the network (AV:N, AC:L, UI:N) to receive data the system's authorization model forbids, bypassing privilege scopes. The fix is to bring WebSocket handlers into parity with REST counterparts by adding the declarative privilege checks. Patches are available: 5.12.8 and 5.13.2.

## Affected products

- Yamcs Yamcs 5.12.7 and earlier, 5.13.0 to 5.13.1

## Identifiers

- CVE-2026-55545
- GHSA-fwww-cp23-7f5g

## Timeline

- 2026-08-28: disclosed
- 2026-07-14: patched: Patches released for versions 5.12.8 and 5.13.2

## References

- [https://api.github.com/users/cipher-creator](https://api.github.com/users/cipher-creator)
- [https://github.com/cipher-creator](https://github.com/cipher-creator)
- [https://api.github.com/users/cipher-creator/gists%7B/gist_id%7D](https://api.github.com/users/cipher-creator/gists%7B/gist_id%7D)
- [https://api.github.com/users/cipher-creator/repos](https://api.github.com/users/cipher-creator/repos)
- [https://avatars.githubusercontent.com/u/249282395?v=4](https://avatars.githubusercontent.com/u/249282395?v=4)
- [https://api.github.com/users/cipher-creator/events%7B/privacy%7D](https://api.github.com/users/cipher-creator/events%7B/privacy%7D)

## Related threats

- [Yamcs DOM XSS in Extension Routing](https://junglewise.ai/threats/cve-2026-55566-yamcs-dom-xss-in-extension-routing)
- [Yamcs remote code execution via unescaped StreamSQL LIKE pattern](https://junglewise.ai/threats/cve-2026-55565-yamcs-remote-code-execution-via-unescaped-streamsql-like-pattern)
- [Yamcs remote code execution via YAML injection in instance template](https://junglewise.ai/threats/cve-2026-55559-yamcs-remote-code-execution-via-yaml-injection-in-instance)
- [Yamcs unauthenticated directory traversal](https://junglewise.ai/threats/cve-2026-55552-yamcs-unauthenticated-directory-traversal)
- [Yamcs reflected XSS in authorize endpoint](https://junglewise.ai/threats/cve-2026-55549-yamcs-reflected-xss-in-authorize-endpoint)