These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-55548 debrief: The PacketsApi.exportPackets endpoint in Yamcs, prior to versions 5.12.8 and 5.13.2, failed to enforce object-level ReadPacket privileges when a request omitted specific packet names. This oversight allowed a low-privileged or zero-privilege authenticated user to dump the entire raw telemetry packet archive and bypass the role-based access control model. The issue is fixed in versi [truncated]
A critical vulnerability was discovered in Yamcs, a mission control framework. An authenticated user with the ChangeMissionDatabase privilege could exploit this vulnerability to achieve remote code execution on the underlying host operating system. The issue is fixed in versions 5.12.7 and 5.13.0. The vulnerability allows an attacker to override an existing Python algorithm's logic through the mission dat [truncated]
CVE-2026-46562 is a critical vulnerability in Yamcs' Nashorn ScriptEngine. Prior to version 5.12.7, the ScriptEngine was constructed without a ClassFilter, allowing users with ChangeMissionDatabase privilege to override algorithms and execute arbitrary OS commands as the Yamcs process. In default configurations, the built-in guest user has superuser=true, making the issue reachable without authentication. [truncated]
CVE-2026-44596: Yamcs Authentication Endpoint Lacks Rate Limiting. Prior to 5.12.7, the authentication endpoint POST /auth/token in yamcs-core lacked rate limiting, account lockout, or failed-attempt throttling. This allowed unauthenticated remote attackers to perform unlimited password-guessing attempts against any user account, significantly increasing the risk of successful brute-force attacks. The iss [truncated]
CVE-2026-44595 is a MEDIUM severity vulnerability in the Yamcs mission control framework. The IAM API endpoints in yamcs-core did not enforce the required SystemPrivilege.ControlAccess check, allowing any authenticated user to enumerate all user accounts. This issue is fixed in versions 5.12.7 and 5.13.0. Organizations should review their deployments and apply patches to prevent unauthorized access to use [truncated]
CVE-2026-42568 is a MEDIUM severity vulnerability in Yamcs, a mission control framework. An LDAP injection vulnerability exists in `org.yamcs.security.LdapAuthModule` when constructing search filters. The username parameter is inserted directly into the LDAP filter without proper RFC 4515 escaping. This vulnerability was patched in versions 5.13.0 and 5.12.7.