CVE-2026-42568 (Yamcs LDAP Injection): Patch Guidance & Risk Analysis

Technical summary

The vulnerability resides in `org.yamcs.security.LdapAuthModule`, which constructs LDAP search filters dynamically using user-supplied username input. The code fails to apply RFC 4515 escaping—the standard mechanism for neutralizing special characters in LDAP filter strings. An attacker with valid credentials can inject LDAP filter metacharacters (such as `*`, `(`, `)`, and `\`) to alter filter logic, potentially broadening search scope or bypassing attribute-based restrictions. This is classified as LDAP Injection (CWE-90) and differs from SQL injection primarily in syntax and attack mechanics, though the underlying principle—unvalidated user input in a query language—remains identical.

Business impact

Yamcs operates in mission-critical environments managing satellite communications, spacecraft telemetry, and ground station operations. Compromise of authentication or disclosure of LDAP directory contents (usernames, email addresses, organizational structure) could expose operational security posture and enable social engineering or credential harvesting. The risk is mitigated by the authentication requirement—only insiders or users with valid credentials can attempt the attack—but the confidentiality breach of directory data during normal operations poses reputational and compliance concerns in regulated aerospace sectors.

Affected systems

Yamcs versions prior to 5.13.0 and 5.12.7 are affected. Organizations running mission control systems on older Yamcs releases should audit their deployments. The vulnerability does not affect systems using alternative (non-LDAP) authentication backends, though many aerospace and government operators standardize on LDAP for centralized identity management.

Exploitability

Exploitation requires valid Yamcs user credentials and network access to an LDAP-enabled Yamcs instance. An attacker cannot exploit this vulnerability remotely without first obtaining legitimate login credentials. The attack is straightforward once authenticated—injecting filter syntax into the username field during login—but the need for valid credentials substantially reduces the practical attack surface. This is reflected in the CVSS score of 4.3 (Medium), which accounts for the authentication prerequisite (PR:L).

Remediation

Upgrade Yamcs to version 5.13.0 or later (for the 5.13.x branch) or version 5.12.7 or later (for the 5.12.x branch). These releases implement proper RFC 4515 escaping of username parameters before LDAP filter construction. Organizations unable to upgrade immediately should consider restricting network access to Yamcs instances or enforcing multi-factor authentication on Yamcs user accounts to reduce insider risk.

Patch guidance

Apply patches to affected Yamcs instances according to your maintenance windows. Version 5.13.0 and 5.12.7 are confirmed fixes—verify availability in the official Yamcs repository or release notes. If running 5.14.x or later, no action is required as these versions already include the patch. Test patched instances in a staging environment to confirm LDAP authentication functionality remains intact before production deployment. Update dependency manifests and container images if applicable.

Detection guidance

Monitor Yamcs authentication logs for unusual LDAP filter syntax in login attempts, particularly usernames containing LDAP metacharacters (`*`, `(`, `)`, `\`, or encoded equivalents). Search for multiple failed login attempts followed by successful authentication using the same crafted username—a pattern consistent with exploitation attempts. Enable detailed LDAP transaction logging on your directory service to detect anomalous queries originating from Yamcs. Review LDAP access logs for searches with unexpectedly broad scope or unusual attribute queries from Yamcs service accounts.

Why prioritize this

Although rated MEDIUM severity, this vulnerability merits rapid attention in aerospace and satellite operations environments where mission continuity is paramount. The authentication requirement prevents mass exploitation, but insider threats—a persistent concern in defense and space sectors—combined with the exposure of sensitive LDAP directory information justify expedited patching. Organizations in non-regulated sectors using Yamcs for non-critical purposes may apply standard patching timelines.

Risk score, explained

CVSS 4.3 reflects a bounded threat: network-accessible (AV:N), low attack complexity (AC:L), but crucially requiring authenticated login (PR:L) with no user interaction (UI:N). Impact is confidentiality loss only (C:L), affecting directory information disclosure rather than system integrity or availability. The authentication gate prevents autonomous propagation and reduces the exploit likelihood to insider or credential-compromise scenarios. Organizations with strong access controls and monitoring may assess local risk as lower than the base score suggests.

Frequently asked questions