CVE-2026-42568CWE-90

Yamcs Vulnerable to LDAP Injection in LdapAuthModule

Medium · published June 10, 2026

CVSS v3.1
4.3
EPSS
1%
Percentile
62.8
In the wild
Unconfirmed
What it is

Yamcs is a mission control framework. Prior to versions 5.13.0 and 5.12.7, an LDAP injection vulnerability exists in `org.yamcs.security.LdapAuthModule` when constructing search filters. The username parameter is inserted directly into the LDAP filter without proper RFC 4515 escaping. Versions 5.13.0 and 5.12.7 patch the issue.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01009 · 62.8th percentile
Weakness
CWE-90 · Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
Published
2026-06-10T22:15Z
EPSS history
Timeline
  • 10 JUN 22:15Z
    Yamcs Vulnerable to LDAP Injection in LdapAuthModule
    cvelistv5