Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-55548— Yamcs: Insecure Direct Object Reference (IDOR) in PacketsApi allows unprivileged users to dump all telemetry packets

Quick assessment

Affected
yamcs yamcs
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Yamcs yamcs是Yamcs团队的航天器遥测数据处理与监控系统。 Yamcs 5.12.8之前版本和5.13.0至5.13.2之前版本存在安全漏洞，该漏洞源于PacketsApi.exportPackets端点未能强制执行对象级ReadPacket权限，可能导致低权限或零权限认证用户转储整个原始遥测数据包存档，绕过基于角色的访问控制模型。

CVSS 4.3 · Medium EPSS 0.36% · P28

Affected Version Matrix 2

VendorProduct Version RangeStatus
yamcs yamcs < 5.12.8 affected
>= 5.13.0, < 5.13.2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-55548

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Yamcs: Insecure Direct Object Reference (IDOR) in PacketsApi allows unprivileged users to dump all telemetry packets
Source: CVE Program / CVE List V5
Vulnerability Description
Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, the PacketsApi.exportPackets endpoint in yamcs-core/src/main/java/org/yamcs/http/api/PacketsApi.java failed to enforce object-level ReadPacket privileges when a request omitted specific packet names: with an empty name list the ctx.checkObjectPrivileges(ObjectPrivilegeType.ReadPacket, nameSet) call passed over an empty set, no WHERE pname IN filter was applied to the resulting SELECT * FROM tm query, and the onTuple handler streamed every retrieved packet without any per-row authorization check, so a low-privileged or zero-privilege authenticated user could dump the entire raw telemetry packet archive and bypass the role-based access control model. This issue is fixed in versions 5.12.8 and 5.13.2, which enforce per-packet ReadPacket checks in exportPackets.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
访问控制不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
Yamcs 权限许可和访问控制问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Yamcs yamcs是Yamcs团队的航天器遥测数据处理与监控系统。 Yamcs 5.12.8之前版本和5.13.0至5.13.2之前版本存在安全漏洞，该漏洞源于PacketsApi.exportPackets端点未能强制执行对象级ReadPacket权限，可能导致低权限或零权限认证用户转储整个原始遥测数据包存档，绕过基于角色的访问控制模型。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
yamcs yamcs < 5.12.8 -

II. Public POCs for CVE-2026-55548

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-55548

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-55548 (2)

Vendor Advisories for CVE-2026-55548 (1)

Vendor Pages for CVE-2026-55548 (2)

Same Patch Batch · yamcs · 2026-07-16 · 6 CVEs total

CVE-2026-46562 9.8 CRITICAL Yamcs: Remote Code Execution via Mission Database algorithm override
CVE-2026-46621 9.1 CRITICAL Yamcs: Authenticated Remote Code Execution (RCE) via Jython Algorithm Code Injection
CVE-2026-44632 9.1 CRITICAL Yamcs: Server-Side Code Injection (RCE) via Janino Expression Engine in `JavaExprAlgorithm
CVE-2026-44596 6.5 MEDIUM Yamcs: No Rate Limiting on Authentication Endpoint
CVE-2026-44595 4.3 MEDIUM Yamcs: Unauthorized user enumeration via IAM API endpoints

IV. Related Vulnerabilities

Same product: yamcs
Same vendor: yamcs
Same weakness: CWE-284

V. Comments for CVE-2026-55548

No comments yet

Leave a comment