CVE-2026-55545 yamcs CVE debrief

Who should care

Defenders and administrators of Yamcs deployments should assess exposure and prioritize verification and remediation efforts to prevent unauthorized access to sensitive information.

Why it matters

CVE-2026-55545 allows low-privilege authenticated users to access unauthorized information in Yamcs deployments. Defenders should prioritize verification, remediation, and compensating controls to limit unauthorized access.

• Potential unauthorized access to telemetry packets
• Potential unauthorized access to algorithm status
• Potential unauthorized access to mission database change information
• Verification of affected versions and remediation priority

Technical summary

Yamcs WebSocket subscription handlers fail to enforce privileges required by equivalent REST endpoints, allowing low-privilege authenticated users to access telemetry packets, algorithm status, and mission database change information outside their assigned authorization scope. This vulnerability is due to inadequate privilege checks in the WebSocket subscription handlers, which enable unauthorized access to sensitive information. The affected versions are prior to 5.12.8 and 5.13.2, and defenders should prioritize verifying and upgrading to these versions.

Defensive priority

Defenders should prioritize verifying and upgrading to versions 5.12.8 or 5.13.2, assessing exposure in their environments, and implementing compensating controls to limit unauthorized access.

Recommended defensive actions

• Verify and upgrade to Yamcs versions 5.12.8 or 5.13.2
• Assess exposure in environments and implement compensating controls
• Limit unauthorized access to telemetry packets, algorithm status, and mission database change information
• Review system logs for potential exploitation
• Implement monitoring and detection controls for exposed assets
• Track exceptions and retest remediated assets
• Document evidence of verification and remediation efforts

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, affected versions, and fixed versions. However, the scope of affected deployments and potential impact require further verification. Defenders should verify the presence of affected versions in their environments, review system logs for potential exploitation, and implement compensating controls to limit unauthorized access. The CVE Program record and NVD entry serve as primary sources for this information, but additional verification steps are necessary to ensure the

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.