PT-2026-43444 · Maven+1 · Org.Yamcs:Yamcs-Core+1

Published 2026-05-26 · Updated 2026-06-10 · CVE-2026-42568

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Yamcs versions prior to 5.12.7 Yamcs versions prior to 5.13.0

Description An LDAP injection occurs in org.yamcs.security.LdapAuthModule during the construction of search filters. The username parameter is inserted directly into the LDAP filter without proper RFC 4515 escaping, which is a standard for encoding search filters to prevent special characters from altering the query logic. This allows LDAP wildcard characters such as *, (, and ) to be processed without sanitization. An attacker with a known valid password can use a value like username=* to authenticate as the first user returned by the LDAP search, potentially leading to horizontal privilege escalation. This issue affects deployments using org.yamcs.security.LdapAuthModule in the etc/security.yaml configuration file.

Recommendations Update to version 5.12.7. Update to version 5.13.0.

Exploit

Fix

Weakness Enumeration

CWE-90

Related Identifiers

CVE-2026-42568

GHSA-CQH3-JG8P-336J

Affected Products

Org.Yamcs:Yamcs-Core

Yamcs

References · 8

• 🔥 https://exploit-db.com/exploits/52603 · Exploit
• https://osv.dev/vulnerability/GHSA-cqh3-jg8p-336j · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42568 · Security Note
• https://github.com/yamcs/yamcs/security/advisories/GHSA-cqh3-jg8p-336j · Note
• https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7 · Note
• https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0 · Note
• https://github.com/yamcs/yamcs · Note
• https://t.me/cveNotify/166970 · Telegram Post