CVE-2026-42568

Yamcs Vulnerable to LDAP Injection in LdapAuthModule

Yamcs is a mission control framework. Prior to versions 5.13.0 and 5.12.7, an LDAP injection vulnerability exists in `org.yamcs.security.LdapAuthModule` when constructing search filters. The username parameter is inserted directly into the LDAP filter without proper RFC 4515 escaping. Versions 5.13.0 and 5.12.7 patch the issue.

Affected

yamcs

CVSS v3.1 GITHUB

4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS

1.01% chance of exploitation in the next 30 days, 63rd percentile

Published

2026-06-10

Updated

2026-06-11

Proof-of-concept exploits (2)

• advisories/GHSA-cqh3-jg8p-336j
• ex-cal1bur/CVE-2026-425680★ · 2026-05-29

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/52603

References

• CVE Record
• NVD entry

Related

• CVE-2025-24071
• CVE-2026-44595
• CVE-2026-44596