What is the CVSS score of CVE-2026-55548?

CVE-2026-55548 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a public PoC exploit available for CVE-2026-55548?

Yes, a public proof-of-concept exploit is available for CVE-2026-55548. Prioritise patching immediately. EPSS: 0.2%.

Is there a patch available for CVE-2026-55548?

Yes, a patch is available for CVE-2026-55548. Update the affected software to the latest version immediately.

Yamcs CVE-2026-55548

EUVD-2026-44960 MEDIUM

Improper Access Control (CWE-284)

2026-07-16 GitHub_M

GHSA-8xjq-pr36-ccgf

Authentication Bypass Java Yamcs

4.3

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-accessible endpoint requires authenticated session (PR:L); C:H because the entire raw telemetry archive is exposed, not a partial data subset.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jul 16, 2026 - 18:18 EUVD

Source Code Evidence Fetched

Jul 16, 2026 - 16:37 vuln.today

Analysis Generated

Jul 16, 2026 - 16:37 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

7 maven packages depend on org.yamcs:yamcs-core (7 direct, 0 indirect)

Ecosystem-wide dependent count for version 5.13.0.

DescriptionCVE.org

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, the PacketsApi.exportPackets endpoint in yamcs-core/src/main/java/org/yamcs/http/api/PacketsApi.java failed to enforce object-level ReadPacket privileges when a request omitted specific packet names: with an empty name list the ctx.checkObjectPrivileges(ObjectPrivilegeType.ReadPacket, nameSet) call passed over an empty set, no WHERE pname IN filter was applied to the resulting SELECT * FROM tm query, and the onTuple handler streamed every retrieved packet without any per-row authorization check, so a low-privileged or zero-privilege authenticated user could dump the entire raw telemetry packet archive and bypass the role-based access control model. This issue is fixed in versions 5.12.8 and 5.13.2, which enforce per-packet ReadPacket checks in exportPackets.

AnalysisAI

Telemetry archive exposure in Yamcs mission control framework allows any authenticated user to dump the entire raw packet archive by exploiting a broken object-level authorization check in the exportPackets API. Versions prior to 5.12.8 (stable) and 5.13.2 (development) are affected. No public exploit or CISA KEV listing exists, but the attack requires only a valid session and a trivially crafted HTTP request, making it immediately actionable for any insider or compromised account.

Technical ContextAI

Yamcs is a Java-based open-source mission control framework used in spacecraft operations. The vulnerable component is the PacketsApi.exportPackets endpoint in yamcs-core/src/main/java/org/yamcs/http/api/PacketsApi.java. The root cause (CWE-284: Improper Access Control) is a logic flaw in the object-level privilege model: the call ctx.checkObjectPrivileges(ObjectPrivilegeType.ReadPacket, nameSet) evaluates against the caller-supplied name set, which is empty when no packet names are specified in the request. An empty set trivially passes the check - there is nothing to deny. Consequently, no WHERE pname IN (...) filter is applied to the downstream SELECT * FROM tm query, and the onTuple handler streams every retrieved row unconditionally. The fix (commits b566beceba98cc35514b0e1519be126b8c5a0438 and c743cc3acf5b5c53ff5181b94eacc21340f70dd9) adds a per-row guard - if (ctx.user.hasObjectPrivilege(ObjectPrivilegeType.ReadPacket, pname)) - inside onTuple before any packet data is emitted, closing the bypass at the streaming layer.

RemediationAI

Upgrade to Yamcs 5.12.8 (stable) or 5.13.2 (development), both confirmed patched releases available at https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.8 and https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.2. If an immediate upgrade is not feasible, restrict network access to the Yamcs HTTP API to only explicitly authorized internal users or services at the network perimeter - this reduces exposure but does not eliminate the risk from already-authenticated internal actors. Do not rely on absence of ReadPacket grants as a compensating control; the bypass defeats grant-based restrictions entirely. Removing authenticated access from untrusted user accounts is the only fully effective workaround short of patching.