CVE-2026-55548: Yamcs: Insecure Direct Object Reference (IDOR) in PacketsApi allows unprivileged users to dump all telemetry packets
The PacketsApi.exportPackets endpoint in Yamcs fails to properly enforce object-level privileges (ReadPacket) when an API request omits specific packet names. As a result, an attacker with a low-privileged account (or any authenticated user with zero privileges) can dump the entire archive of raw telemetry packets for a Yamcs instance. This leads to a massive Information Disclosure of sensitive mission telemetry, completely bypassing the intended Role-Based Access Control (RBAC) model.
References
- github.com/advisories/GHSA-8xjq-pr36-ccgf
- github.com/yamcs/yamcs/commit/b566beceba98cc35514b0e1519be126b8c5a0438
- github.com/yamcs/yamcs/commit/c743cc3acf5b5c53ff5181b94eacc21340f70dd9
- github.com/yamcs/yamcs/releases/tag/yamcs-5.12.8
- github.com/yamcs/yamcs/releases/tag/yamcs-5.13.2
- github.com/yamcs/yamcs/security/advisories/GHSA-8xjq-pr36-ccgf
- nvd.nist.gov/vuln/detail/CVE-2026-55548
Code Behaviors & Features
Detect and mitigate CVE-2026-55548 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →