Yamcs up to 5.12.7/5.13.1 Packets Endpoint PacketsApi.java exportPackets nameSet access control

Summaryinfo

A vulnerability labeled as problematic has been found in Yamcs up to 5.12.7/5.13.1. This issue affects the function exportPackets of the file yamcs-core/src/main/java/org/yamcs/http/api/PacketsApi.java of the component Packets Endpoint. Such manipulation of the argument nameSet leads to access control. This vulnerability is uniquely identified as CVE-2026-55548. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability was found in Yamcs up to 5.12.7/5.13.1. It has been rated as problematic. Affected by this issue is the function exportPackets of the file yamcs-core/src/main/java/org/yamcs/http/api/PacketsApi.java of the component Packets Endpoint. The manipulation of the argument nameSet with an unknown input leads to a access control vulnerability. Using CWE to declare the problem leads to CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. Impacted is confidentiality. CVE summarizes:

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, the PacketsApi.exportPackets endpoint in yamcs-core/src/main/java/org/yamcs/http/api/PacketsApi.java failed to enforce object-level ReadPacket privileges when a request omitted specific packet names: with an empty name list the ctx.checkObjectPrivileges(ObjectPrivilegeType.ReadPacket, nameSet) call passed over an empty set, no WHERE pname IN filter was applied to the resulting SELECT * FROM tm query, and the onTuple handler streamed every retrieved packet without any per-row authorization check, so a low-privileged or zero-privilege authenticated user could dump the entire raw telemetry packet archive and bypass the role-based access control model. This issue is fixed in versions 5.12.8 and 5.13.2, which enforce per-packet ReadPacket checks in exportPackets.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-55548 since 06/17/2026. The exploitation is known to be easy. The attack may be launched remotely. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1068.

Upgrading to version 5.12.8 or 5.13.2 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• Yamcs

Version

• 5.12.0
• 5.12.1
• 5.12.2
• 5.12.3
• 5.12.4
• 5.12.5
• 5.12.6
• 5.12.7
• 5.13.0
• 5.13.1

Website

• Product: https://github.com/yamcs/yamcs/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion