CVE-2026-42568

EUVD-2026-36196
Yamcs is a mission control framework. Prior to versions 5.13.0 and 5.12.7, an LDAP injection vulnerability exists in `org.yamcs.security.LdapAuthModule` when constructing search filters. The username parameter is inserted directly into the LDAP filter without proper RFC 4515 escaping. Versions 5.13.0 and 5.12.7 patch the issue.
LDAP Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 74%
Common Weakness Enumeration
References
https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7
https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0
https://github.com/yamcs/yamcs/security/advisories/GHSA-cqh3-jg8p-336j