CVE-2026-42568

4.3 mediumEPSS 1.0%

Medium (4.3). EPSS 1.0% chance of exploitation in the next 30 days. Fixed in org.yamcs:yamcs-core 5.12.7.

Yamcs is a mission control framework. Prior to versions 5.13.0 and 5.12.7, an LDAP injection vulnerability exists in `org.yamcs.security.LdapAuthModule` when constructing search filters. The username parameter is inserted directly into the LDAP filter without proper RFC 4515 escaping. Versions 5.13.0 and 5.12.7 patch the issue.

Severity

CVSS 3.1

4.3 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS: 1.0% chance of exploitation in the next 30 days; higher than 63% of CVEs (scores of 2026-10-31)
CWE: CWE-90
Published: 2026-06-10
Modified: 2026-07-21
Record from: the NVD, synced 2026-10-19

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-cqh3-jg8p-336j	Maven	org.yamcs:yamcs-core	<5.12.7	5.12.7

References

https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7
https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0
https://github.com/yamcs/yamcs/security/advisories/GHSA-cqh3-jg8p-336j

Check your stack JSON