Description

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs WebSocket subscription handlers fail to enforce the privileges required by equivalent REST endpoints. PacketsApi.subscribePackets exposes the packets WebSocket topic without ObjectPrivilegeType.ReadPacket, ProcessingApi.subscribeAlgorithmStatus exposes the algorithm-status WebSocket topic without ObjectPrivilegeType.ReadAlgorithm, and MdbOverrideApi.subscribeMdbChanges exposes the mdb-changes WebSocket topic without SystemPrivilege.GetMissionDatabase. A low-privilege authenticated user can receive telemetry packets, algorithm status, and mission database change information outside the assigned authorization scope. This issue is fixed in versions 5.12.8 and 5.13.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-28T20:18:28.380Z",
  "pubdate": "2026-08-28T20:18:28.380Z",
  "executiveSummary": "Yamcs is susceptible to an authorization bypass vulnerability within its WebSocket subscription handlers, allowing authenticated users to access data streams for which they lack the required privileges. The vulnerability stems from a failure to perform adequate access control checks equivalent to those implemented in the system's REST API.\nThe flaw affects the PacketsApi, ProcessingApi, and MdbOverrideApi components. By leveraging these WebSocket endpoints, a low-privileged authenticated user can bypass security constraints to intercept sensitive telemetry, monitor algorithm statuses, and observe mission database modifications. This unauthorized data exposure violates the principle of least privilege, potentially exposing proprietary mission data and operational intelligence to unauthorized entities.\nExploitation requires an authenticated user session, but does not necessitate elevated permissions or administrative rights. The risk is significant in multi-user environments where strict data segmentation is required. The vulnerability is remediated in versions 5.12.8 and 5.13.2.",
  "technicalDetails": "The root cause of this vulnerability lies in an inconsistent enforcement of access control policies between the Yamcs REST API and the WebSocket-based messaging infrastructure. While REST endpoints correctly implement authorization checks—specifically ObjectPrivilegeType.ReadPacket, ObjectPrivilegeType.ReadAlgorithm, and SystemPrivilege.GetMissionDatabase—the corresponding WebSocket subscription handlers fail to perform these validation steps during the session handshake or subscription request process.\nThe vulnerable components include: PacketsApi.subscribePackets, which manages WebSocket topics for telemetry; ProcessingApi.subscribeAlgorithmStatus, which governs algorithm state monitoring; and MdbOverrideApi.subscribeMdbChanges, which controls notifications regarding Mission Database (MDB) changes.\nThe attack flow proceeds as follows: 1) An authenticated user initiates a WebSocket connection to the Yamcs server. 2) The user transmits a subscription frame for restricted topics (e.g., specific telemetry streams or MDB change logs). 3) The server-side subscription handler neglects to verify if the user's security token possesses the required privileges (e.g., ObjectPrivilegeType.ReadPacket). 4) The server registers the subscriber to the requested topic and begins broadcasting live data frames to the unauthorized client.\nBecause the WebSocket protocol maintains a persistent connection, this unauthorized data streaming persists for the duration of the session, allowing an attacker to exfiltrate continuous telemetry feeds or monitor real-time database modifications without triggering typical REST-based audit logs. The lack of granular privilege checks at the WebSocket level effectively neuters the server's broader authorization framework for these specific telemetry and state-tracking services.\nThis issue affects all Yamcs deployments prior to versions 5.12.8 and 5.13.2. Successful exploitation provides an attacker with unauthorized visibility into mission-critical operational data, enabling potential reconnaissance or intellectual property theft. The vulnerability is constrained to authenticated users; however, the impact is severe due to the sensitive nature of the information exposed via the improperly protected WebSocket channels."
}