Skip to content
OpenAdvisories
Medium · 4.3 Public exploit CVE-2026-42568 EUVD-2026-36196GHSA-cqh3-jg8p-336j

Yamcs Vulnerable to LDAP Injection in LdapAuthModule

Published Jun 10, 2026 · Updated Jun 11, 2026 · Assigned by GitHub_M

Vendor: yamcs Product: yamcs Package: org.yamcs:yamcs-core Ecosystem: Maven

Description

Yamcs is a mission control framework. Prior to versions 5.13.0 and 5.12.7, an LDAP injection vulnerability exists in `org.yamcs.security.LdapAuthModule` when constructing search filters. The username parameter is inserted directly into the LDAP filter without proper RFC 4515 escaping. Versions 5.13.0 and 5.12.7 patch the issue.

Affected products

VendorProductAffectedFixed
yamcs yamcs < 5.12.7 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Exploit-DB 1

GitHub 1 repository

  • ex-cal1bur/CVE-2026-42568 ★ 0 · May 29, 2026

    An LDAP injection vulnerability exists in org.yamcs.security.LdapAuthModule. The username parameter is inserted directly into LDAP search filters without RFC 4515 escaping, allowing authentication by…

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.yamcs:yamcs-core < 5.12.7 5.12.7 GHSA-cqh3-jg8p-336j

References