PatchSiren cyber security CVE debrief
CVE-2026-42568 yamcs CVE debrief
CVE-2026-42568 is a MEDIUM severity vulnerability in Yamcs, a mission control framework. An LDAP injection vulnerability exists in `org.yamcs.security.LdapAuthModule` when constructing search filters. The username parameter is inserted directly into the LDAP filter without proper RFC 4515 escaping. This vulnerability was patched in versions 5.13.0 and 5.12.7.
- Vendor
- yamcs
- Product
- Unknown
- CVSS
- MEDIUM 4.3
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-10
- Original CVE updated
- 2026-06-11
- Advisory published
- 2026-06-10
- Advisory updated
- 2026-06-11
Who should care
Users of Yamcs versions prior to 5.13.0 and 5.12.7 should apply the patches to prevent LDAP injection attacks.
Technical summary
The vulnerability has a CVSS score of 4.3 and is classified as CWE-90. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.
Defensive priority
MEDIUM
Recommended defensive actions
- Apply patches in versions 5.13.0 or 5.12.7 to fix the LDAP injection vulnerability.
- Review and update LDAP authentication configurations to ensure proper escaping of user input.
Evidence notes
The CVE record [cve-org] and NVD detail [nvd] provide official information about the vulnerability. Additional references can be found at [ref-4], [ref-5], and [ref-6].
Official resources
CVE-2026-42568 was published on 2026-06-10T23:16:46.550Z and modified on 2026-06-11T15:30:51.693Z.