CVE-2026-55545: Yamcs Mission Control Auth Bypass Flaw

CVE-2026-55545 Overview

Yamcs is an open-source mission control framework used to operate spacecraft and other remote assets. CVE-2026-55545 is a missing authorization vulnerability [CWE-862] in Yamcs versions prior to 5.12.8 and 5.13.2. WebSocket subscription handlers fail to enforce the same privilege checks required by their equivalent REST endpoints. A low-privilege authenticated user can subscribe to telemetry packets, algorithm status, and mission database change notifications outside their assigned authorization scope. The vulnerability affects three WebSocket topics exposed by PacketsApi.subscribePackets, ProcessingApi.subscribeAlgorithmStatus, and MdbOverrideApi.subscribeMdbChanges.

Critical Impact
Authenticated users with minimal privileges can receive telemetry packets, algorithm status updates, and mission database change events they are not authorized to view, leading to confidentiality loss for spacecraft operations data.

Affected Products

Yamcs versions prior to 5.12.8 (5.12.x branch)
Yamcs versions prior to 5.13.2 (5.13.x branch)
Deployments using WebSocket subscription APIs for packets, algorithm status, or MDB changes

Discovery Timeline

2026-08-28 - CVE-2026-55545 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-55545

Vulnerability Analysis

Yamcs exposes both REST and WebSocket APIs for accessing telemetry, processing, and mission database resources. The REST endpoints correctly enforce object and system privileges. The WebSocket subscription handlers, however, omit the equivalent privilege checks, creating a divergence between the two access paths.

Three specific handlers are affected. PacketsApi.subscribePackets streams telemetry packets to WebSocket clients without validating ObjectPrivilegeType.ReadPacket. ProcessingApi.subscribeAlgorithmStatus streams algorithm state without checking ObjectPrivilegeType.ReadAlgorithm. MdbOverrideApi.subscribeMdbChanges publishes mission database change events without verifying SystemPrivilege.GetMissionDatabase.

Any authenticated user with a valid session can open a WebSocket connection and subscribe to these topics regardless of their assigned role. The result is unauthorized read access to operational spacecraft data.

Root Cause

The root cause is missing authorization checks in the WebSocket subscription path. Developers enforced privileges on REST controllers but did not apply the same checks in the corresponding WebSocket handlers. This is a classic [CWE-862] Missing Authorization pattern where two access paths to the same resource enforce different security controls.

Attack Vector

Exploitation requires network access to the Yamcs HTTP/WebSocket endpoint and valid low-privilege credentials. An attacker authenticates with any account, establishes a WebSocket connection, and issues subscription requests for the packets, algorithm-status, or mdb-changes topics. The server accepts the subscription and begins streaming data that the user should not be able to read.

java

// Patch: yamcs-core/src/main/java/org/yamcs/http/api/MdbOverrideApi.java
    @Override
    public void subscribeMdbChanges(Context ctx, SubscribeMdbChangesRequest request,
            Observer<MdbOverrideInfo> observer) {
+       ctx.checkSystemPrivilege(SystemPrivilege.GetMissionDatabase);
        var processor = ProcessingApi.verifyProcessor(request.getInstance(), request.getProcessor());
        var pdata = processor.getProcessorData();

Source: GitHub Commit 06917318

The fix adds a single ctx.checkSystemPrivilege call at the top of each subscription handler, aligning the WebSocket path with the REST path. Similar patches were applied to PacketsApi.java and the algorithm status subscription handler.

Detection Methods for CVE-2026-55545

Indicators of Compromise

WebSocket subscription requests to the packets, algorithm-status, or mdb-changes topics from user accounts that lack corresponding REST access to the same resources.
Unexpected data egress on WebSocket sessions belonging to low-privilege users.
Yamcs audit logs showing successful WebSocket subscribe operations from accounts with no assigned ReadPacket, ReadAlgorithm, or GetMissionDatabase privileges.

Detection Strategies

Compare WebSocket subscription activity against each user's assigned privileges and alert on subscriptions that would be denied via REST.
Instrument Yamcs with request logging on WebSocket topics and correlate topic access with the authenticated principal's role assignments.
Review historical logs for anomalous subscription patterns preceding the upgrade to 5.12.8 or 5.13.2.

Monitoring Recommendations

Forward Yamcs HTTP and WebSocket access logs to a centralized log platform for retention and analysis.
Baseline normal WebSocket subscription behavior per role and alert on deviations.
Monitor for account enumeration or credential-stuffing patterns against the Yamcs authentication endpoint, since exploitation requires an authenticated session.

How to Mitigate CVE-2026-55545

Immediate Actions Required

Upgrade Yamcs to version 5.12.8 (5.12.x users) or 5.13.2 (5.13.x users) as soon as possible.
Audit existing user accounts and remove or downgrade any accounts that should not have access to telemetry, algorithm, or MDB data.
Rotate credentials for any low-privilege accounts that may have been used to access unauthorized WebSocket topics.

Patch Information

The issue is fixed in Yamcs 5.12.8 and 5.13.2. Patch commits 06917318 and 12864af5 add the missing checkSystemPrivilege and object privilege checks to the affected WebSocket handlers. See the GitHub Security Advisory GHSA-fwww-cp23-7f5g for the official advisory, and the yamcs-5.12.8 release and yamcs-5.13.2 release notes for full change details.

Workarounds

Restrict network access to the Yamcs HTTP/WebSocket endpoint to trusted operator networks using firewall or reverse-proxy rules.
Disable or remove low-privilege user accounts that are not strictly required until patching is complete.
Place an authenticating reverse proxy in front of Yamcs to enforce additional authorization on WebSocket upgrade requests where feasible.

bash

# Example: verify installed Yamcs version and upgrade
yamcs --version

# Upgrade to a fixed release (5.13.x branch)
# Adjust package manager or deployment method for your environment
wget https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.2

# Restart the Yamcs service after upgrade
systemctl restart yamcs