Executive brief
Yamcs is a mission control software system used to manage and archive spacecraft telemetry data. A flaw in its packet export API allows any authenticated user—even those with no explicit access permissions—to download the entire historical telemetry archive by making a request that omits packet-name filters. In an aerospace environment, this bypasses all access controls and exposes sensitive vehicle health, mission data, and classified measurements to unauthorized users.
Technical details
The vulnerability is a logical authorization bypass (IDOR) in the PacketsApi.exportPackets method (yamcs-core/src/main/java/org/yamcs/http/api/PacketsApi.java). The method attempts to verify ReadPacket privileges via ctx.checkObjectPrivileges(ObjectPrivilegeType.ReadPacket, nameSet), but when the request omits packet names, nameSet is empty, and the privilege check loops over an empty set without raising an exception. This allows the unfiltered SQL query (SELECT * FROM tm) to execute. Unlike related methods (streamPackets, exportPacket), the onTuple callback in exportPackets contains no per-row authorization checks and blindly streams all retrieved CCSDS Space Packets to the attacker. Attack vector is network with low privilege requirement (any authenticated user), no user interaction needed. The vulnerability affects Yamcs 5.12.x through 5.13.1 and was patched in 5.12.8 and 5.13.2.
Affected products
- Yamcs Yamcs 5.12.0 through 5.12.7; 5.13.0 through 5.13.1
Timeline
- 2026-07-13: disclosed
- 2026-07-13: patched: Patches released: 5.12.8 and 5.13.2