CVE-2026-55547: Yamcs Mission Control Privilege Escalation

CVE-2026-55547 Overview

CVE-2026-55547 is a missing authorization vulnerability [CWE-285] in Yamcs, an open-source mission control framework used to operate spacecraft and satellite ground systems. Versions prior to 5.12.8 and 5.13.2 omit SystemPrivilege.ControlAccess checks from three endpoints in IamApi: listRoles, getRole, and listPrivileges. Any authenticated account can query GET /api/roles, GET /api/roles/{name}, and GET /api/privileges to enumerate available system privileges and configured role mappings. The disclosure exposes security configuration data that supports targeted privilege-escalation planning. The issue is fixed in Yamcs 5.12.8 and 5.13.2.

Critical Impact
Low-privileged authenticated users can enumerate all Yamcs roles and system privileges, mapping the authorization model to identify accounts and privileges worth targeting for escalation.

Affected Products

Yamcs versions prior to 5.12.8 (5.12.x branch)
Yamcs versions prior to 5.13.2 (5.13.x branch)
Component: yamcs-core/src/main/java/org/yamcs/http/api/IamApi.java

Discovery Timeline

2026-08-28 - CVE-2026-55547 published to the National Vulnerability Database
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-55547

Vulnerability Analysis

Yamcs exposes an Identity and Access Management (IAM) HTTP API through the IamApi class. Three read endpoints on this API return sensitive authorization metadata: the list of defined roles, individual role details, and the catalog of system privileges. The service methods listRoles, getRole, and listPrivileges fail to call ctx.checkSystemPrivilege(SystemPrivilege.ControlAccess) before returning results. Any account holding valid credentials, regardless of assigned privileges, can invoke these endpoints and read the response payloads.

The exposed data includes role names, role-to-privilege mappings, and the full set of system privileges recognized by the deployment. Attackers use this configuration to identify high-value roles, map which privileges guard mission-critical operations, and plan follow-on credential attacks against specific accounts. In ground-segment environments where Yamcs controls telemetry and commanding, this reconnaissance directly supports lateral movement toward command authority.

Root Cause

The root cause is a missing authorization check [CWE-285]. Adjacent IAM endpoints in the same class enforce SystemPrivilege.ControlAccess, but the three affected read methods were shipped without the guard. The patches in commits c2aec1c and dcaec5f add a single ctx.checkSystemPrivilege(SystemPrivilege.ControlAccess) call at the top of each service method.

Attack Vector

Exploitation requires network access to the Yamcs HTTP API and any valid authenticated session. The attacker sends unmodified HTTP GET requests to /api/roles, /api/roles/{name}, or /api/privileges and parses the JSON response to enumerate authorization state. No user interaction, injection payload, or elevated privilege is required.

java

    @Override
    public void listRoles(Context ctx, Empty request, Observer<ListRolesResponse> observer) {
+       ctx.checkSystemPrivilege(SystemPrivilege.ControlAccess);
        SecurityStore securityStore = YamcsServer.getServer().getSecurityStore();
        List<Role> roles = securityStore.getDirectory().getRoles();
        Collections.sort(roles, (p1, p2) -> p1.getName().compareTo(p2.getName()));

Source: Yamcs commit c2aec1c. The patch adds the missing privilege check as the first statement of the handler, blocking unauthorized callers before any directory lookup occurs.

Detection Methods for CVE-2026-55547

Indicators of Compromise

HTTP GET requests to /api/roles, /api/roles/{name}, or /api/privileges originating from accounts that lack the ControlAccess system privilege.
Burst-pattern access to IamApi endpoints from a single session or source address, consistent with automated enumeration.
Successful 200 OK responses to role and privilege queries where the caller has no operational reason to access authorization metadata.

Detection Strategies

Parse Yamcs HTTP access logs and alert on requests to the three affected paths correlated with the caller's assigned privileges.
Deploy a Web Application Firewall (WAF) or reverse-proxy rule that flags unauthenticated-privilege accounts hitting /api/roles* and /api/privileges.
Compare Yamcs server version strings against the fixed releases 5.12.8 and 5.13.2 during scheduled asset inventory scans.

Monitoring Recommendations

Ingest Yamcs HTTP API logs into a central Security Information and Event Management (SIEM) platform and build a saved search for the affected endpoints.
Baseline normal callers of the IamApi endpoints so that unexpected service accounts or user identities surface as anomalies.
Track authentication events for accounts that subsequently query IAM endpoints, since this sequence often precedes privilege-escalation attempts.

How to Mitigate CVE-2026-55547

Immediate Actions Required

Upgrade Yamcs to version 5.12.8 if running the 5.12.x branch, or to 5.13.2 if running the 5.13.x branch.
Audit existing Yamcs accounts and revoke credentials for users or services that do not require API access.
Review access logs for prior requests to /api/roles, /api/roles/{name}, and /api/privileges and investigate any unexpected callers.

Patch Information

The fix is delivered in Yamcs release 5.12.8 and Yamcs release 5.13.2. The underlying code changes are in commits c2aec1c and dcaec5f. Refer to GHSA-cvw4-55pp-3hfq for the official advisory.

Workarounds

Restrict network access to the Yamcs HTTP API using firewall rules or reverse-proxy allowlists until upgrade is possible.
Front the Yamcs API with a reverse proxy that denies requests to /api/roles, /api/roles/{name}, and /api/privileges for non-administrator accounts.
Reduce the pool of authenticated accounts to the minimum required for operations, limiting the number of identities that can trigger the flaw.

bash

# Example nginx rule to block IAM enumeration paths for non-admin sources
location ~ ^/api/(roles|privileges) {
    allow 10.0.0.0/24;   # admin subnet
    deny  all;
    proxy_pass http://yamcs-backend;
}