CVE-2026-55521

CVE-2026-55521 is a missing-authorization flaw (CWE-862) in Yamcs, an open-source mission control framework, in several API handlers: IndexesApi.listPacketIndex, IndexesApi.listEventIndex, Cop1Api.disable, Cop1Api.resume, Cop1Api.initialize, Cop1Api.updateConfig, and TimeApi.setTime. An authenticated low-privilege user can invoke these endpoints directly without the required ObjectPrivilegeType.ReadPacket or SystemPrivilege.ControlLinks privileges. This lets the attacker read packet and event index metadata (telemetry metadata disclosure), disable, resume, initialize or reconfigure COP-1 links (disrupting telecommand handling), and change the system/simulation time, affecting confidentiality, integrity, and availability. Only Yamcs deployments running versions prior to 5.12.8 or 5.13.2 are affected, primarily space agencies, satellite operators, and ground-segment teams using Yamcs for mission control. No public proof-of-concept or in-the-wild exploitation is known; EPSS estimates roughly a 0.4% probability of exploitation within 30 days.

What to do: Upgrade to Yamcs 5.12.8 if running the 5.12.x line, or 5.13.2 if running the 5.13.x line. As an interim mitigation, restrict access to the affected Indexes, COP-1, and Time API endpoints to privileged users, and review which low-privilege accounts can reach them. Check logs for unexpected COP-1 link state changes or time changes made by non-privileged accounts.