What is the CVSS score of CVE-2026-55548?

CVE-2026-55548 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.

Is there a patch available for CVE-2026-55548?

Yes, a patch is available for CVE-2026-55548. Update the affected software to the latest version immediately.

Yamcs CVE-2026-55548

EUVD-2026-44960 MEDIUM

Improper Access Control (CWE-284)

2026-07-16 GitHub_M

Authentication Bypass Java Yamcs

4.3

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-accessible endpoint requires authenticated session (PR:L); C:H because the entire raw telemetry archive is exposed, not a partial data subset.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jul 16, 2026 - 18:18 EUVD

Source Code Evidence Fetched

Jul 16, 2026 - 16:37 vuln.today

Analysis Generated

Jul 16, 2026 - 16:37 vuln.today

DescriptionCVE.org

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, the PacketsApi.exportPackets endpoint in yamcs-core/src/main/java/org/yamcs/http/api/PacketsApi.java failed to enforce object-level ReadPacket privileges when a request omitted specific packet names: with an empty name list the ctx.checkObjectPrivileges(ObjectPrivilegeType.ReadPacket, nameSet) call passed over an empty set, no WHERE pname IN filter was applied to the resulting SELECT * FROM tm query, and the onTuple handler streamed every retrieved packet without any per-row authorization check, so a low-privileged or zero-privilege authenticated user could dump the entire raw telemetry packet archive and bypass the role-based access control model. This issue is fixed in versions 5.12.8 and 5.13.2, which enforce per-packet ReadPacket checks in exportPackets.

AnalysisAI

Telemetry archive exposure in Yamcs mission control framework allows any authenticated user to dump the entire raw packet archive by exploiting a broken object-level authorization check in the exportPackets API. Versions prior to 5.12.8 (stable) and 5.13.2 (development) are affected. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Authenticate to Yamcs HTTP API

Delivery

Send exportPackets request with empty name list

Exploit

Privilege check passes on empty set unconditionally

Execution

SELECT * FROM tm executes without pname filter

Persist

onTuple streams all packets without per-row check

Impact

Full telemetry archive exfiltrated

Access

Authenticate to Yamcs HTTP API

Delivery

Send exportPackets request with empty name list

Exploit

Privilege check passes on empty set unconditionally

Execution

SELECT * FROM tm executes without pname filter

Persist

onTuple streams all packets without per-row check

Impact

Full telemetry archive exfiltrated

Vulnerability AssessmentAI

Exploitation	A valid authenticated session on the Yamcs instance is required (confirmed by CVSS PR:L). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The vendor-assigned CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) understates real-world impact by classifying confidentiality as Low. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An authenticated Yamcs user with no ReadPacket privileges sends a standard HTTP export request to the PacketsApi.exportPackets endpoint with an empty packet names list. The server evaluates privileges against the empty set (passing trivially), executes SELECT * FROM tm without any name filter, and streams the full raw telemetry archive in the response. …
Remediation	Upgrade to Yamcs 5.12.8 (stable) or 5.13.2 (development), both confirmed patched releases available at https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.8 and https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.2. … Detailed patch versions, workarounds, and compensating controls in full report.