CVE-2026-42568: Yamcs LDAP Injection Vulnerability

CVE-2026-42568 Overview

CVE-2026-42568 is an LDAP injection vulnerability in Yamcs, an open-source mission control framework used in aerospace and satellite operations. The flaw resides in org.yamcs.security.LdapAuthModule and affects all Yamcs versions prior to 5.13.0 and 5.12.7. The authentication module inserts the username parameter directly into LDAP search filters without performing RFC 4515 escaping. An authenticated attacker can manipulate filter syntax to alter directory query logic. The vulnerability is classified as [CWE-90] Improper Neutralization of Special Elements used in an LDAP Query.

Critical Impact
An authenticated attacker can inject crafted LDAP filter metacharacters into the username field to alter search behavior and potentially enumerate directory entries through LdapAuthModule.

Affected Products

Yamcs versions prior to 5.12.7 (5.12.x branch)
Yamcs versions prior to 5.13.0 (5.13.x branch)
Deployments using org.yamcs.security.LdapAuthModule for authentication

Discovery Timeline

2026-06-10 - CVE-2026-42568 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-42568

Vulnerability Analysis

The vulnerability exists in the Yamcs authentication subsystem, specifically inside org.yamcs.security.LdapAuthModule. When a user submits credentials, the module constructs an LDAP search filter to locate the matching directory entry. The username supplied by the client is concatenated into the filter string without escaping characters reserved by RFC 4515, including *, (, ), \, and the NUL byte.

An attacker who controls the username field can inject filter syntax that changes the semantics of the search. This allows the attacker to broaden the filter, bypass certain matching constraints, or enumerate user attributes by observing differential authentication behavior. The Common Weakness Enumeration assigns this class of issue [CWE-90].

Root Cause

The root cause is missing input neutralization. LdapAuthModule builds the search filter through string concatenation rather than using a parameterized filter API or applying javax.naming.ldap escaping routines. Special LDAP metacharacters in the username are passed through to the directory server, which interprets them as filter operators instead of literal data.

Attack Vector

Exploitation occurs over the network against the Yamcs authentication endpoint. The attacker requires low-privilege access sufficient to submit credentials. The attacker supplies a username containing LDAP filter metacharacters such as *)(uid=* to manipulate the constructed filter. Because the impact is limited to confidentiality of directory data and no integrity or availability impact is reported, the attacker can primarily use the flaw to enumerate accounts or infer attribute values bound to the LDAP directory.

No public proof-of-concept exploit code is referenced in the advisory. The vulnerability mechanism is documented in GitHub Security Advisory GHSA-cqh3-jg8p-336j.

Detection Methods for CVE-2026-42568

Indicators of Compromise

Authentication log entries containing LDAP metacharacters such as *, (, ), or \ in the username field submitted to Yamcs
Unusually broad or malformed LDAP search filters originating from the Yamcs application account in directory server logs
Repeated failed authentication attempts from a single source followed by successful enumeration patterns

Detection Strategies

Inspect Yamcs application logs for username values that contain reserved LDAP filter characters
Correlate Yamcs authentication events with downstream LDAP server query logs to identify malformed or wildcard-laden filters
Alert on authentication usernames whose length or character profile deviates from organizational naming conventions

Monitoring Recommendations

Enable verbose audit logging on the upstream LDAP or Active Directory server to capture full search filters originating from Yamcs
Forward Yamcs and directory server logs to a centralized analytics platform for cross-source correlation
Establish a baseline of normal LDAP search filter patterns issued by LdapAuthModule and alert on deviations

How to Mitigate CVE-2026-42568

Immediate Actions Required

Upgrade Yamcs to version 5.13.0 or, on the 5.12.x branch, to 5.12.7 as documented in the vendor releases
Audit Yamcs authentication and LDAP server logs for prior injection attempts using filter metacharacters
Restrict network access to the Yamcs authentication endpoint to trusted administrative networks until patching is complete

Patch Information

The Yamcs maintainers released fixed versions that apply RFC 4515 escaping inside LdapAuthModule before building the search filter. Upgrade to yamcs-5.13.0 for the current branch or yamcs-5.12.7 for the maintenance branch. Additional details are provided in the GitHub Security Advisory GHSA-cqh3-jg8p-336j.

Workarounds

Place a reverse proxy or web application firewall in front of Yamcs to reject usernames containing LDAP filter metacharacters such as *, (, ), and \
Configure the LDAP bind account used by Yamcs with the minimum directory privileges required, limiting the data exposed through any successful injection
Disable LdapAuthModule and switch to an alternative authentication module supported by Yamcs until the upgrade can be deployed

bash

# Upgrade Yamcs to a patched release
# For the 5.13 branch
wget https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0

# For the 5.12 maintenance branch
wget https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7

# Verify the running version after deployment
yamcsadmin version