Yamcs CVE-2026-42568
MEDIUM
GHSA-cqh3-jg8p-336j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain one valid LDAP account credential
-
DeliverySend POST /auth/token with username=*
-
ExploitUnescaped wildcard expands LDAP search filter
-
ExecutionDirectory returns first matching user entry
-
PersistReceive auth token for that account
-
ImpactAccess Yamcs as different user identity
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization LDAP query parameterization
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires three concrete conditions: (1) the target Yamcs instance must be configured to use org.yamcs.security.LdapAuthModule as its authentication backend in etc/security.yaml - deployments using other auth providers are not affected; (2) the attacker must possess at least one valid LDAP account password (PR:L per CVSS vector), meaning this is not an unauthenticated attack - an initial credential is prerequisite; (3) network access to the Yamcs HTTP API on port 8090 is required (AV:N). Exploitation is limited to horizontal privilege escalation - the attacker authenticates as whichever user happens to be returned first by the LDAP search, not an arbitrary chosen target, so the specific account obtained may be unpredictable. The CVSS vector confirms no user interaction is required (UI:N) and attack complexity is low (AC:L) once the prerequisites are met. |
| Impact | The CVSS 3.1 base score of 4.3 (Medium) is computed from AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, reflecting network reachability, low complexity, but a requirement for an existing low-privilege authenticated account. The confidentiality impact is rated Low and integrity/availability are unaffected, which accurately reflects the limited scope of account pivoting rather than full system compromise. No EPSS data was provided and this CVE is not listed in CISA KEV, indicating no confirmed widespread active exploitation at time of analysis. However, a working proof-of-concept curl command is included in the public GitHub advisory, meaningfully lowering the barrier to exploitation. For Yamcs deployments in mission-critical or space operations environments, even horizontal privilege escalation between operator accounts carries disproportionate operational risk beyond what the CVSS score alone conveys. The low attack complexity combined with the public PoC warrants treating this as higher priority than a raw 4.3 score suggests for affected deployments. |
| Exploit ScenarioDerived | An attacker with any valid LDAP account credential - for example, a low-privilege Yamcs operator account - submits a POST request to the /auth/token endpoint with |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 27, 2026
LDAP injection in Yamcs LdapAuthModule (yamcs-core < 5.12.7) enables horizontal privilege escalation for authenticated low-privilege users. By submitting a wildcard character as the username alongside a single known valid LDAP password, an attacker causes the unescaped LDAP search filter to match the first user returned by the directory query, effectively authenticating as that account. A proof-of-concept exploit is publicly available in the GitHub advisory; no CISA KEV listing exists, but the low attack complexity and published PoC make this a credible threat for any Yamcs deployment using LDAP authentication.
RemediationAI
Vendor-released patch: yamcs-core 5.12.7 (and 5.13.0). Upgrade the org.yamcs:yamcs-core Maven dependency to version 5.12.7 or 5.13.0 immediately; release notes for 5.12.7 confirm security updates are included (https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7). If immediate upgrade is not feasible, the primary compensating control is to disable the LdapAuthModule entirely by removing or replacing the org.yamcs.security.LdapAuthModule entry in etc/security.yaml with an alternative authentication provider - this eliminates the attack surface entirely but requires an alternative identity store. A secondary control is to restrict network access to the Yamcs auth endpoint (default port 8090) to trusted networks only, limiting the pool of potential attackers to those already inside the perimeter; this does not eliminate the vulnerability but raises the bar for exploitation. Blocking wildcard-containing usernames at a reverse proxy or WAF layer (e.g., rejecting requests where the username field contains *, (, or )) is a viable short-term filter, though WAF bypass risks apply. No side effects are expected from the upstream patch as it only adds RFC 4515 escaping to the filter-construction code path.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in maven
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Yamcs (Yet Another Mission Control System) is a Java-based spacecraft operations framework; the affected component is the Maven artifact org.yamcs:yamcs-core. The vulnerability is rooted in CWE-90 (Improper Neutralization of Special Elements in an LDAP Query). In LdapAuthModule.java at line 233, the username parameter is interpolated directly into an LDAP search filter string via a simple string replace - userFilter.replace("{0}", username) - without applying RFC 4515 escape sequences for special characters such as *, (, ), \, and \0. Because LDAP wildcard semantics are preserved, a submitted username of * expands the filter to match all directory entries, and the code returns the first result. The fix requires pre-processing input through an RFC 4515-compliant escape function before filter construction, as documented in the advisory.
Know when LDAP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Primary rating from Vendor (https://github.com/yamcs/yamcs) · only source for this CVE.
CVSS VectorVendor: https://github.com/yamcs/yamcs
DescriptionCVE.org
Summary
An LDAP injection vulnerability exists in org.yamcs.security.LdapAuthModule when constructing search filters. The username parameter is inserted directly into the LDAP filter without proper RFC 4515 escaping.
Root Cause
File: yamcs-core/src/main/java/org/yamcs/security/LdapAuthModule.java:233
The username parameter is inserted directly into an LDAP search filter without RFC 4515 escaping:
// VULNERABLE
var filter = userFilter.replace("{0}", username);
var searchResult = getSingleResult(ctx, userBase, filter, controls);LDAP wildcard characters (*, (, )) are accepted without sanitization.
Impact
With a known valid password, username=* authenticates as the first user returned by the LDAP search - enabling horizontal privilege escalation between accounts sharing similar passwords or when the attacker knows one valid password.
This affects deployments that use org.yamcs.security.LdapAuthModule in their etc/security.yaml configuration file.
Proof of Concept
curl -X POST "http://TARGET:8090/auth/token" \
-d "grant_type=password&username=*&password=known_password"
# Returns token for first matching LDAP userFix
Apply RFC 4515 escaping before filter construction:
private static String escapeLdapFilter(String input) {
return input
.replace("\\", "\\5c")
.replace("*", "\\2a")
.replace("(", "\\28")
.replace(")", "\\29")
.replace("\0", "\\00");
}
var filter = userFilter.replace("{0}", escapeLdapFilter(username));Blast Radius
ecosystem impact- 6 maven packages depend on org.yamcs:yamcs-core (6 direct, 0 indirect)
Ecosystem-wide dependent count for version 5.12.7.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Exploit-DB
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Affected Products (CPE)CVE.org
The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a
In Joomla!. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required,
An issue was discovered on Accellion FTA devices before FTA_9_12_180. Rated critical severity (CVSS 9.8), this vulnerabi
An authenticated GitLab user can seize control of an existing LDAP-backed account on instances that have both OmniAuth S
LDAP injection in Central Dogma's Apache Shiro-based authentication module exposes unauthenticated remote attackers to a
Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for aut
Dolibarr 11.0.3 contains a persistent cross-site scripting vulnerability in LDAP synchronization settings that allows at
A reflected cross-site scripting (xss) vulnerability exists in the ldapUser functionality of MedDream PACS Premium 7.3.6
Authentication bypass in Apache Druid versions 0.17.0 through 35.x. Affects all versions prior to 36.0.0 when specific p
Arbitrary certificate disclosure in Apache CXF's XKMS server lets remote attackers abuse an LDAP injection flaw (CWE-90)
An issue was discovered in linqi before 1.4.0.1 on Windows. Rated critical severity (CVSS 9.8), this vulnerability is re
A vulnerability, which was classified as problematic, has been found in Jahastech NxFilter 4.3.2.5.jsp?actionFlag=test&i