{"id":"CVE-2026-55545","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-55545","summary":"Yamcs's WebSocket subscription handlers omit the privilege checks their REST siblings enforce","details":"**Asset / scope:** Yamcs 5.12.7 WebSocket topics (`packets`, `algorithm-status`, `mdb-changes`)\n\n## Summary\n\nSeveral WebSocket subscription handlers do not perform the privilege check that their REST counterparts\nenforce, so a principal subscribing over WebSocket receives data the REST API would have scoped or denied.\n\n## Root cause\n\n- `packets` (`PacketsApi.subscribePackets`) performs no `ReadPacket` check, while the REST siblings do\n  (`listPackets:128`, `streamPackets:256`, `subscribeContainers:538`). A principal with a narrow\n  `ReadPacket` scope receives the raw binary of all TM packets on the processor.\n- `algorithm-status` (`ProcessingApi.subscribeAlgorithmStatus`) performs no check, while REST\n  `getAlgorithmStatus` enforces `checkObjectPrivileges(ReadAlgorithm, ...)` (`:467`).\n- `mdb-changes` (`MdbOverrideApi.subscribeMdbChanges`) performs no check, while base MDB reads require\n  `GetMissionDatabase`.\n\n## Remediation\n\nBring each WebSocket subscription handler to parity with its REST sibling's privilege check\n(`ReadPacket`, `ReadAlgorithm`, `GetMissionDatabase`). This is the same declarative fail-closed fix as\nReport 1.\n\n## Supporting material\n\nSubsystem source audit of the WS-vs-REST authorization parity. Available on request.\n\n--\n\n## Disclosure and credit\n\nThis was found by Cipher / Causal Security - https://causalsecurity.com/. We are coordinating disclosure\nvia this report and request CVEs where you agree they qualify. We propose the 90-day window stated in your\nsecurity policy. We might publish a write-up after a fix and the agreed window.","published":"2026-08-28T17:10:26Z","modified":"2026-08-28T17:15:07.183016729Z","cvss":{"score":6.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Maven","name":"org.yamcs:yamcs-core","fixedVersion":"5.12.8"},{"ecosystem":"Maven","name":"org.yamcs:yamcs-core","fixedVersion":"5.13.2"}],"fix":{"url":"https://github.com/yamcs/yamcs/commit/0691731846c5a0aca81b88fabbd2cd51d56fe076","label":"yamcs/yamcs@0691731"},"references":[{"type":"WEB","url":"https://github.com/yamcs/yamcs/security/advisories/GHSA-fwww-cp23-7f5g"},{"type":"WEB","url":"https://github.com/yamcs/yamcs/commit/0691731846c5a0aca81b88fabbd2cd51d56fe076"},{"type":"WEB","url":"https://github.com/yamcs/yamcs/commit/12864af555e6ca4941b01c1f1217859cc0492ce0"},{"type":"PACKAGE","url":"https://github.com/yamcs/yamcs"},{"type":"WEB","url":"https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.8"},{"type":"WEB","url":"https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.2"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-28T17:15:07.183016729Z"}}