CVE-2026-55548: Yamcs missing authorization in PacketsApi telemetry export

CVE-2026-55548 · Severity: medium · CVSS 4.3 · Published 2026-07-16

Yamcs is a mission control software system used to manage and archive spacecraft telemetry data. A flaw in its packet export API allows any authenticated user—even those with no explicit access permissions—to download the entire historical telemetry archive by making a request that omits packet-name filters. In an aerospace environment, this bypasses all access controls and exposes sensitive vehicle health, mission data, and classified measurements to unauthorized users.

Technologies: org.yamcs:yamcs-core (Maven), Yamcs. Vendors: Maven, Yamcs.

Quick answers

Is CVE-2026-55548 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55548 being exploited in the wild.
How severe is CVE-2026-55548?
Medium severity, with a CVSS score of 4.3, published 16 July 2026.
Which products and versions are affected?
org.yamcs:yamcs-core (Maven) ECOSYSTEM:introduced=5.13.0,fixed=5.13.2; Yamcs < 5.12.8, >= 5.13.0, < 5.13.2.
Is there a fix for CVE-2026-55548?
Yes. org.yamcs:yamcs-core (Maven): upgrade to 5.13.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55548 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-55548?
Check whether you run org.yamcs:yamcs-core (Maven) or Yamcs at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.yamcs:yamcs-core (Maven): upgrade to 5.13.2 or later
    # set org.yamcs:yamcs-core to 5.13.2 in your pom.xml or build.gradle

Technical details

The vulnerability is a logical authorization bypass (IDOR) in the PacketsApi.exportPackets method (yamcs-core/src/main/java/org/yamcs/http/api/PacketsApi.java). The method attempts to verify ReadPacket privileges via ctx.checkObjectPrivileges(ObjectPrivilegeType.ReadPacket, nameSet), but when the request omits packet names, nameSet is empty, and the privilege check loops over an empty set without raising an exception. This allows the unfiltered SQL query (SELECT * FROM tm) to execute. Unlike related methods (streamPackets, exportPacket), the onTuple callback in exportPackets contains no per-row authorization checks and blindly streams all retrieved CCSDS Space Packets to the attacker. Attack vector is network with low privilege requirement (any authenticated user), no user interaction needed. The vulnerability affects Yamcs 5.12.x through 5.13.1 and was patched in 5.12.8 and 5.13.2.

Affected products

  • Yamcs Yamcs 5.12.0 through 5.12.7; 5.13.0 through 5.13.1

Identifiers

  • CVE-2026-55548
  • GHSA-8xjq-pr36-ccgf

Timeline

  • 2026-07-13: disclosed
  • 2026-07-13: patched: Patches released: 5.12.8 and 5.13.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.