CVE-2026-42568

MEDIUM

YAMCS yamcs-core 5.12.7 - LDAP Injection

STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2026-42568. PoCs published by Daniel Miranda, ex-cal1bur.

AI-analyzed exploit summary This PoC demonstrates an LDAP injection vulnerability in YAMCS yamcs-core versions prior to 5.12.7, allowing authentication bypass by manipulating the username parameter in LDAP search filters. The exploit sends crafted payloads to the authentication endpoint to achieve unauthorized access.

Description

Yamcs is a mission control framework. Prior to versions 5.13.0 and 5.12.7, an LDAP injection vulnerability exists in `org.yamcs.security.LdapAuthModule` when constructing search filters. The username parameter is inserted directly into the LDAP filter without proper RFC 4515 escaping. Versions 5.13.0 and 5.12.7 patch the issue.

Exploits (2)

exploitdb WORKING POC
by Daniel Miranda · pythonwebappsmultiple
https://www.exploit-db.com/exploits/52603

This PoC demonstrates an LDAP injection vulnerability in YAMCS yamcs-core versions prior to 5.12.7, allowing authentication bypass by manipulating the username parameter in LDAP search filters. The exploit sends crafted payloads to the authentication endpoint to achieve unauthorized access.

Classification
Working Poc 100%
Attack Type
Auth Bypass
Complexity
Trivial
Reliability
Reliable
Target: YAMCS yamcs-core < 5.12.7
No auth needed
Prerequisites: LdapAuthModule configured in yamcs.yaml
mistral-large-3 · analyzed May 31, 2026 Full analysis →
nomisec WORKING POC
by ex-cal1bur · poc
https://github.com/ex-cal1bur/CVE-2026-42568

The repository contains a functional Python PoC for CVE-2026-42568, an LDAP injection vulnerability in YAMCS LdapAuthModule. The exploit demonstrates authentication bypass by injecting malicious LDAP filter strings into the username parameter.

Classification
Working Poc 100%
Attack Type
Auth Bypass
Complexity
Trivial
Reliability
Reliable
Target: yamcs-core < 5.12.7 (with LDAP auth enabled)
No auth needed
Prerequisites: YAMCS instance with LDAP authentication configured · Network access to the YAMCS server
mistral-large-3 · analyzed Jul 02, 2026 Full analysis →

References (3)

Core 3
Core References

Scores

CVSS v3 4.3
EPSS 0.0103
EPSS Percentile 60.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-90
Status published
Products (2)
org.yamcs/yamcs-core 0 - 5.12.7Maven
yamcs/yamcs < 5.12.7
Published Jun 10, 2026
Tracked Since May 31, 2026