What is the CVSS score of CVE-2026-42568?

CVE-2026-42568 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.8%.

Is there a public PoC exploit available for CVE-2026-42568?

Yes, a public proof-of-concept exploit is available for CVE-2026-42568. Prioritise patching immediately. EPSS: 0.8%.

Is there a patch available for CVE-2026-42568?

Yes, a patch is available for CVE-2026-42568. Update the affected software to the latest version immediately.

Yamcs CVE-2026-42568

MEDIUM

LDAP Injection (CWE-90)

2026-05-26 https://github.com/yamcs/yamcs

GHSA-cqh3-jg8p-336j

Java LDAP Privilege Escalation Code Injection

4.3

CVSS 3.1 · Vendor: https://github.com/yamcs/yamcs

Severity by source

Vendor (https://github.com/yamcs/yamcs) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from Vendor (https://github.com/yamcs/yamcs) · only source for this CVE.

CVSS VectorVendor: https://github.com/yamcs/yamcs

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

May 27, 2026 - 00:04 vuln.today

Analysis Generated

May 27, 2026 - 00:04 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

6 maven packages depend on org.yamcs:yamcs-core (6 direct, 0 indirect)

Ecosystem-wide dependent count for version 5.12.7.

DescriptionCVE.org

Summary

An LDAP injection vulnerability exists in org.yamcs.security.LdapAuthModule when constructing search filters. The username parameter is inserted directly into the LDAP filter without proper RFC 4515 escaping.

Root Cause

File: yamcs-core/src/main/java/org/yamcs/security/LdapAuthModule.java:233

The username parameter is inserted directly into an LDAP search filter without RFC 4515 escaping:

java

// VULNERABLE
var filter = userFilter.replace("{0}", username);
var searchResult = getSingleResult(ctx, userBase, filter, controls);

LDAP wildcard characters (*, (, )) are accepted without sanitization.

Impact

With a known valid password, username=* authenticates as the first user returned by the LDAP search - enabling horizontal privilege escalation between accounts sharing similar passwords or when the attacker knows one valid password.

This affects deployments that use org.yamcs.security.LdapAuthModule in their etc/security.yaml configuration file.

Proof of Concept

bash

curl -X POST "http://TARGET:8090/auth/token" \
  -d "grant_type=password&username=*&password=known_password"
# Returns token for first matching LDAP user

Fix

Apply RFC 4515 escaping before filter construction:

java

private static String escapeLdapFilter(String input) {
    return input
        .replace("\\", "\\5c")
        .replace("*",  "\\2a")
        .replace("(",  "\\28")
        .replace(")",  "\\29")
        .replace("\0", "\\00");
}
var filter = userFilter.replace("{0}", escapeLdapFilter(username));

AnalysisAI

LDAP injection in Yamcs LdapAuthModule (yamcs-core < 5.12.7) enables horizontal privilege escalation for authenticated low-privilege users. By submitting a wildcard character as the username alongside a single known valid LDAP password, an attacker causes the unescaped LDAP search filter to match the first user returned by the directory query, effectively authenticating as that account. A proof-of-concept exploit is publicly available in the GitHub advisory; no CISA KEV listing exists, but the low attack complexity and published PoC make this a credible threat for any Yamcs deployment using LDAP authentication.

Technical ContextAI

Yamcs (Yet Another Mission Control System) is a Java-based spacecraft operations framework; the affected component is the Maven artifact org.yamcs:yamcs-core. The vulnerability is rooted in CWE-90 (Improper Neutralization of Special Elements in an LDAP Query). In LdapAuthModule.java at line 233, the username parameter is interpolated directly into an LDAP search filter string via a simple string replace - userFilter.replace("{0}", username) - without applying RFC 4515 escape sequences for special characters such as *, (, ), \, and \0. Because LDAP wildcard semantics are preserved, a submitted username of * expands the filter to match all directory entries, and the code returns the first result. The fix requires pre-processing input through an RFC 4515-compliant escape function before filter construction, as documented in the advisory.

RemediationAI

Vendor-released patch: yamcs-core 5.12.7 (and 5.13.0). Upgrade the org.yamcs:yamcs-core Maven dependency to version 5.12.7 or 5.13.0 immediately; release notes for 5.12.7 confirm security updates are included (https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7). If immediate upgrade is not feasible, the primary compensating control is to disable the LdapAuthModule entirely by removing or replacing the org.yamcs.security.LdapAuthModule entry in etc/security.yaml with an alternative authentication provider - this eliminates the attack surface entirely but requires an alternative identity store. A secondary control is to restrict network access to the Yamcs auth endpoint (default port 8090) to trusted networks only, limiting the pool of potential attackers to those already inside the perimeter; this does not eliminate the vulnerability but raises the bar for exploitation. Blocking wildcard-containing usernames at a reverse proxy or WAF layer (e.g., rejecting requests where the username field contains *, (, or )) is a viable short-term filter, though WAF bypass risks apply. No side effects are expected from the upstream patch as it only adds RFC 4515 escaping to the filter-construction code path.