Description
Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, the PacketsApi.exportPackets endpoint in yamcs-core/src/main/java/org/yamcs/http/api/PacketsApi.java failed to enforce object-level ReadPacket privileges when a request omitted specific packet names: with an empty name list the ctx.checkObjectPrivileges(ObjectPrivilegeType.ReadPacket, nameSet) call passed over an empty set, no WHERE pname IN filter was applied to the resulting SELECT * FROM tm query, and the onTuple handler streamed every retrieved packet without any per-row authorization check, so a low-privileged or zero-privilege authenticated user could dump the entire raw telemetry packet archive and bypass the role-based access control model. This issue is fixed in versions 5.12.8 and 5.13.2, which enforce per-packet ReadPacket checks in exportPackets.
Affected products
spaceapplications: yamcs
References6
- github.com/yamcs/yamcs/security/advisories/GHSA-8xjq-pr36-ccgf ExploitMitigationVendor Advisory
- github.com/yamcs/yamcs/security/advisories/GHSA-8xjq-pr36-ccgf ExploitMitigationVendor Advisory
- github.com/yamcs/yamcs/commit/b566beceba98cc35514b0e1519be126b8… Patch
- github.com/yamcs/yamcs/commit/c743cc3acf5b5c53ff5181b94eacc2134… Patch
- github.com/yamcs/yamcs/releases/tag/yamcs-5.12.8 Release Notes
- github.com/yamcs/yamcs/releases/tag/yamcs-5.13.2 Release Notes
Metrics
- CVSS 3.1
-
4.3
MEDIUM
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - EPSS — exploit probability
- 0% percentile: 30 · as of 15 November 2026
- CWE
- CWE-284CWE-862
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.