---
id: CVE-2026-55545
title: Yamcs is a mission control framework
summary: >-
  Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs
  WebSocket subscription handlers fail to enforce the privileges required by
  equivalent REST endpoints. PacketsApi.subscribePackets exposes the packets
  WebSocket topic…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-862
vendor: yamcs
product: 'org.yamcs:yamcs-core'
affected:
  - 'org.yamcs:yamcs-core <= 5.12.7'
  - 'org.yamcs:yamcs-core >= 5.13.0, <= 5.13.1'
patched:
  - 'org.yamcs:yamcs-core 5.12.8'
  - 'org.yamcs:yamcs-core 5.13.2'
published: '2026-08-28'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T21:08:37.320'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-55545'
references:
  - url: >-
      https://github.com/yamcs/yamcs/commit/0691731846c5a0aca81b88fabbd2cd51d56fe076
    label: security-advisories@github.com
  - url: >-
      https://github.com/yamcs/yamcs/commit/12864af555e6ca4941b01c1f1217859cc0492ce0
    label: security-advisories@github.com
  - url: 'https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.8'
    label: security-advisories@github.com
  - url: 'https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.2'
    label: security-advisories@github.com
  - url: 'https://github.com/yamcs/yamcs/security/advisories/GHSA-fwww-cp23-7f5g'
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-fwww-cp23-7f5g'
tags:
  - nvd
  - ghsa
  - maven
epss: 0.00331
epssPercentile: 0.2647
aliases:
  - GHSA-fwww-cp23-7f5g
ecosystem: maven
ingestedAt: '2026-08-28T17:22:56.241Z'
---

## Overview

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs WebSocket subscription handlers fail to enforce the privileges required by equivalent REST endpoints. PacketsApi.subscribePackets exposes the packets WebSocket topic without ObjectPrivilegeType.ReadPacket, ProcessingApi.subscribeAlgorithmStatus exposes the algorithm-status WebSocket topic without ObjectPrivilegeType.ReadAlgorithm, and MdbOverrideApi.subscribeMdbChanges exposes the mdb-changes WebSocket topic without SystemPrivilege.GetMissionDatabase. A low-privilege authenticated user can receive telemetry packets, algorithm status, and mission database change information outside the assigned authorization scope. This issue is fixed in versions 5.12.8 and 5.13.2.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-55545)

Affected packages:

- `org.yamcs:yamcs-core <= 5.12.7`
- `org.yamcs:yamcs-core >= 5.13.0, <= 5.13.1`

Patched in:

- `org.yamcs:yamcs-core 5.12.8`
- `org.yamcs:yamcs-core 5.13.2`

Source: https://github.com/advisories/GHSA-fwww-cp23-7f5g