CVE-2026-55521: Yamcs Mission Control Authorization Bypass

CVE-2026-55521 Overview

CVE-2026-55521 is a missing authorization vulnerability [CWE-862] in Yamcs, an open-source mission control framework used to operate spacecraft and other remote systems. Versions prior to 5.12.8 and 5.13.2 omit privilege checks in several API endpoints, including IndexesApi.listPacketIndex, IndexesApi.listEventIndex, Cop1Api.disable, Cop1Api.resume, Cop1Api.initialize, Cop1Api.updateConfig, and TimeApi.setTime. An authenticated low-privilege user can read telemetry metadata, alter Communications Operation Procedure-1 (COP-1) link state, and manipulate simulation time without holding the required privileges.

Critical Impact

Any authenticated user can disclose packet and event index metadata, disrupt telecommand handling by toggling COP-1 links, and manipulate simulation time, affecting mission integrity and availability.

Affected Products

• Yamcs versions prior to 5.12.8 (5.12.x branch)
• Yamcs versions prior to 5.13.2 (5.13.x branch)
• Yamcs deployments that expose the HTTP API to authenticated low-privilege users

Discovery Timeline

• 2026-08-28 - CVE-2026-55521 published to the National Vulnerability Database
• 2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-55521

Vulnerability Analysis

Yamcs implements role-based access control using privilege classes such as ObjectPrivilegeType and SystemPrivilege. Multiple API handlers dispatch requests without invoking the corresponding privilege check on the caller's context. As a result, the server treats any authenticated session as sufficient authorization for privileged operations.

The impact spans three functional areas. IndexesApi.listPacketIndex and IndexesApi.listEventIndex expose telemetry and event index metadata without verifying ObjectPrivilegeType.ReadPacket. The Cop1Api methods (disable, resume, initialize, updateConfig) allow modification of COP-1 link state without SystemPrivilege.ControlLinks, disrupting telecommand delivery. TimeApi.setTime allows adjustment of simulation time without any privilege check, so the patch introduces a new ControlTime system privilege.

Root Cause

The root cause is missing authorization enforcement in server-side request handlers. Yamcs's Context class provides helpers such as checkParameterPrivilege, but the affected API methods did not call an equivalent check for the required privileges before executing the requested operation.

Attack Vector

Exploitation requires network access to the Yamcs HTTP API and valid low-privilege credentials. No user interaction is required. An attacker sends normal API requests against the vulnerable endpoints and receives privileged results or effects.

// Patch excerpt from yamcs-core/src/main/java/org/yamcs/http/Context.java
// Adds a new helper enforcing that the user holds ANY object privilege of the given type
public void checkAnyObjectPrivilege(ObjectPrivilegeType type) throws ForbiddenException {
    if (!user.hasAnyObjectPrivilege(type)) {
        throw new ForbiddenException("Missing object privilege '" + type + "'");
    }
}

public void checkParameterPrivilege(ObjectPrivilegeType type, Collection<Parameter> objects)
        throws ForbiddenException {
    checkParameterPrivilege(type, objects.toArray(new Parameter[objects.size()]));
}

public void checkParameterPrivilege(ObjectPrivilegeType type, Parameter... parameters) throws ForbiddenException {
    for (Parameter parameter : parameters) {
        if (!user.hasParameterPrivilege(type, parameter)) {
            throw new ForbiddenException(
                    "No " + type + " authorization for '" + parameter.getQualifiedName() + "'");
        }
    }
}

Source: Yamcs Commit 405139af

Detection Methods for CVE-2026-55521

Indicators of Compromise

• HTTP requests from low-privilege accounts targeting /api/archive/*/packet-index or /api/archive/*/event-index paths that return non-empty result sets.
• API calls to Cop1 endpoints (disable, resume, initialize, updateConfig) from accounts not assigned the ControlLinks system privilege.
• Requests to TimeApi.setTime from users not holding an administrative role, followed by unexpected shifts in the simulation clock.

Detection Strategies

• Correlate the identity of API callers with their assigned Yamcs privileges and flag any successful invocation of the affected endpoints by users lacking ReadPacket, ControlLinks, or the new ControlTime privilege.
• Baseline COP-1 link state transitions per operator and alert on state changes outside the expected operational window.
• Monitor for unexplained changes in mission time reported by the Yamcs TimeService.

Monitoring Recommendations

• Enable Yamcs access logging on all HTTP API routes and forward logs to a central analytics platform for privilege-aware analysis.
• Track version strings returned by /api/version across deployments to confirm patched builds (5.12.8 or 5.13.2) are in use.
• Alert on ForbiddenException responses appearing after the upgrade, as these confirm that previously silent unauthorized calls are now being blocked.

How to Mitigate CVE-2026-55521

Immediate Actions Required

• Upgrade Yamcs to version 5.12.8 on the 5.12.x branch or 5.13.2 on the 5.13.x branch.
• Review user and role assignments to ensure only operators who require them hold ObjectPrivilegeType.ReadPacket, SystemPrivilege.ControlLinks, and the new ControlTime privilege.
• Rotate credentials for any accounts suspected of abusing the affected endpoints before the upgrade.

Patch Information

The issue is fixed by commits 405139af and 493563679, which add the missing privilege checks and introduce a ControlTime system privilege. Fixed binaries are distributed in the Yamcs 5.12.8 release and the Yamcs 5.13.2 release. Full advisory details are available in GitHub Security Advisory GHSA-962x-ccwf-8x6p.

Workarounds

• Restrict network reachability of the Yamcs HTTP API to trusted operator workstations using firewall rules or a reverse proxy access control list.
• Temporarily disable low-privilege accounts on internet-exposed Yamcs instances until the upgrade to 5.12.8 or 5.13.2 is applied.
• Place the Yamcs API behind an authenticating gateway that enforces per-endpoint authorization based on user role.

# Verify Yamcs version after upgrade
curl -s -u operator:<password> https://yamcs.example.local/api/general | jq '.yamcsVersion'
# Expected output: "5.12.8" or "5.13.2"