Most recent entries from all

EUVD-2026-338337

2026-10-06T13:51:11.922794+00:00

EUVD-2026-338337

fkie_cve-2026-55548

2026-10-06T13:51:11.922829+00:00

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, the PacketsApi.exportPackets endpoint in yamcs-core/src/main/java/org/yamcs/http/api/PacketsApi.java failed to enforce object-level ReadPacket privileges when a request omitted specific packet names: with an empty name list the ctx.checkObjectPrivileges(ObjectPrivilegeType.ReadPacket, nameSet) call passed over an empty set, no WHERE pname IN filter was applied to the resulting SELECT * FROM tm query, and the onTuple handler streamed every retrieved packet without any per-row authorization check, so a low-privileged or zero-privilege authenticated user could dump the entire raw telemetry packet archive and bypass the role-based access control model. This issue is fixed in versions 5.12.8 and 5.13.2, which enforce per-packet ReadPacket checks in exportPackets.

GHSA-8xjq-pr36-ccgf — Yamcs: Insecure Direct Object Reference (IDOR) in PacketsApi allows unprivileged users to dump all telemetry packets

2026-10-06T13:51:11.922864+00:00

Affected: Maven: org.yamcs:yamcs-core

## Summary The `PacketsApi.exportPackets` endpoint in Yamcs fails to properly enforce object-level privileges (`ReadPacket`) when an API request omits specific packet names. As a result, an attacker with a low-privileged account (or any authenticated user with zero privileges) can dump the entire archive of raw telemetry packets for a Yamcs instance. This leads to a massive Information Disclosure of sensitive mission telemetry, completely bypassing the intended Role-Based Access Control (RBAC) model.

## Vulnerability Details In `yamcs-core/src/main/java/org/yamcs/http/api/PacketsApi.java`, the `exportPackets` method processes requests to export raw packets from the `tm` (telemetry archive) table.

```java @Override public void exportPackets(Context ctx, ExportPacketsRequest request, Observer observer) { String instance = InstancesApi.verifyInstance(request.getInstance());

Set nameSet = new HashSet<>(request.getNameList()); ctx.checkObjectPrivileges(ObjectPrivilegeType.ReadPacket, nameSet);

SqlBuilder sqlb = new SqlBuilder(XtceTmRecorder.TABLE_NAME); // ... time filters ...

if (request.getNameCount() > 0) { sqlb.whereColIn("pname", nameSet); } String sql = sqlb.toString(); // ... ``` The method attempts to verify privileges using `ctx.checkObjectPrivileges(ObjectPrivilegeType.ReadPacket, nameSet)`. However, if the `request.getNameList()` is empty (i.e., t…