Log in Start free

Vulnerability · Published Aug 28, 2026 · Assigned by GitHub_M

CVE-2026-55545Yamcs: WebSocket subscription handlers omit the privilege checks their REST siblings enforce

Medium 6.5

In plain English

A medium-severity missing authorization in yamcs from yamcs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 39% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.5%top 60.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs WebSocket subscription handlers fail to enforce the privileges required by equivalent REST endpoints. PacketsApi.subscribePackets exposes the packets WebSocket topic without ObjectPrivilegeType.ReadPacket, ProcessingApi.subscribeAlgorithmStatus exposes the algorithm-status WebSocket topic without ObjectPrivilegeType.ReadAlgorithm, and MdbOverrideApi.subscribeMdbChanges exposes the mdb-changes WebSocket topic without SystemPrivilege.GetMissionDatabase. A low-privilege authenticated user can receive telemetry packets, algorithm status, and mission database change information outside the assigned authorization scope. This issue is fixed in versions 5.12.8 and 5.13.2.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.yamcs:yamcs-core5.12.8GHSA-fwww-cp23-7f5g
Mavenorg.yamcs:yamcs-core5.13.2GHSA-fwww-cp23-7f5g

Affected products (as reported)

VendorProductVersions
yamcs yamcs < 5.12.8>= 5.13.0, < 5.13.2

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References