medium4.3Public exploit code
CVE-2026-42568
Yamcs Vulnerable to LDAP Injection in LdapAuthModule
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- YAMCS yamcs-core 5.12.7 - LDAP Injection2026-05-30 · webapps · multiple
Impact
Yamcs is a mission control framework. Prior to versions 5.13.0 and 5.12.7, an LDAP injection vulnerability exists in `org.yamcs.security.LdapAuthModule` when constructing search filters. The username parameter is inserted directly into the LDAP filter without proper RFC 4515 escaping. Versions 5.13.0 and 5.12.7 patch the issue.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.yamcs:yamcs-core | < 5.12.7 | 5.12.7 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-cqh3-jg8p-336j
- https://github.com/yamcs/yamcs/security/advisories/GHSA-cqh3-jg8p-336j
- https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7
- https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0
- https://nvd.nist.gov/vuln/detail/CVE-2026-42568