Privilege Escalation in Yamcs Mission Control Framework
CVE-2026-55545
6.5MEDIUM
What is CVE-2026-55545?
The Yamcs Mission Control Framework contains a vulnerability in its WebSocket subscription handling. Prior to versions 5.12.8 and 5.13.2, the framework inadequately enforced required privileges, allowing low-privilege authenticated users to access sensitive telemetry packets, algorithm statuses, and mission database changes without proper authorization. This results from the failure of specific WebSocket topics, such as PacketsApi.subscribePackets and ProcessingApi.subscribeAlgorithmStatus, to enforce necessary object and system privileges. This security issue has been addressed in the subsequent releases.
Affected Version(s)
yamcs < 5.12.8 < 5.12.8
yamcs >= 5.13.0, < 5.13.2 < 5.13.0, 5.13.2