CVE-2026-55548 Yamcs: Insecure Direct Object Reference (IDOR) in PacketsApi allows unprivileged users to dump all telemetry packets
Unprivileged users can dump all telemetry packets by exploiting missing authorization checks in the PacketsApi export endpoint.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-55548?
CVE-2026-55548 is a medium-severity missing authorization vulnerability in yamcs, published on 16 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, the PacketsApi.exportPackets endpoint in yamcs-core/src/main/java/org/yamcs/http/api/PacketsApi.java failed to enforce object-level ReadPacket privileges when a request omitted specific packet names: with an empty name list the ctx.checkObjectPrivileges(ObjectPrivilegeType.ReadPacket, nameSet) call passed over an empty set, no WHERE pname IN filter was applied to the resulting SELECT * FROM tm query, and the onTuple handler streamed every retrieved packet without any per-row authorization check, so a low-privileged or zero-privilege authenticated user could dump the entire raw telemetry packet archive and bypass the role-based access control model. This issue is fixed in versions 5.12.8 and 5.13.2, which enforce per-packet ReadPacket checks in exportPackets.
Which versions are affected by CVE-2026-55548?
4 open source packages ship an affected version, including org.yamcs:yamcs-core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.yamcs:yamcs-core Maven | All versions | 5.12.8 |
org.yamcs:yamcs-core Maven | All versions | 5.12.8 |
org.yamcs:yamcs-core Maven | From 5.13.0 | 5.13.2 |
org.yamcs:yamcs-core Maven | From 5.13.0 | 5.13.2 |
Products include Spaceapplications Yamcs.
How do I fix CVE-2026-55548?
Upgrade org.yamcs:yamcs-core to a fixed version for your release line: 5.12.8 or 5.13.2.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-55548 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-55548 exists.
Other vulnerabilities in yamcs
- CVE-2026-46562 Yamcs: Remote Code Execution via Mission Database algorithm override
- CVE-2026-44632 Yamcs: Server-Side Code Injection (RCE) via Janino Expression Engine in `JavaExprAlgorithmExecutionFactory`
- CVE-2026-46621 Yamcs: Authenticated Remote Code Execution (RCE) via Jython Algorithm Code Injection
- CVE-2023-45278 Yamcs API Directory Traversal vulnerability
- CVE-2023-45277 Yamcs Path Traversal vulnerability
Sources
Also known as GHSA-8xjq-pr36-ccgf.