CVE-2026-42568

🗓️ 10 Jun 2026 22:15:52Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 40 Views🌐 WEB

Yamcs versions before 5.13.0 and 5.12.7 have a directory service injection in the authentication module via unescaped username; fixed in 5.13.0 and 5.12.7.

Reporter	Title	Published	Views	Family All 16
Circl	CVE-2026-42568	21 May 202615:03	–	circl
CNNVD	Yamcs security vulnerabilities	30 May 202600:00	–	cnnvd
Cvelist	CVE-2026-42568 Yamcs Vulnerable to LDAP Injection in LdapAuthModule	10 Jun 202622:15	–	cvelist
GithubExploit	Exploit for CVE-2026-42568	29 May 202614:35	–	githubexploit
Exploit DB	YAMCS yamcs-core 5.12.7 - LDAP Injection	30 May 202600:00	–	exploitdb
EUVD	EUVD-2026-36196	10 Jun 202622:15	–	euvd
Github Security Blog	Yamcs Vulnerable to LDAP Injection in LdapAuthModule	26 May 202623:39	–	github
NVD	CVE-2026-42568	10 Jun 202623:16	–	nvd
OSV	CVE-2026-42568 Yamcs Vulnerable to LDAP Injection in LdapAuthModule	10 Jun 202622:15	–	osv
OSV	GHSA-CQH3-JG8P-336J Yamcs Vulnerable to LDAP Injection in LdapAuthModule	26 May 202623:39	–	osv

Vulners

Node

yamcs yamcsRange<5.12.7

[
  {
    "vendor": "yamcs",
    "product": "yamcs",
    "versions": [
      {
        "version": "< 5.12.7",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/yamcs/yamcs/security/advisories/GHSA-cqh3-jg8p-336j
github	www.github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7
github	www.github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0

Parameter	Position	Path	Description	CWE
username	request body	/auth/token	LDAP injection via username parameter in LDAP search filter leading to authentication bypass	CWE-90
password	request body	/auth/token	LDAP injection via username parameter in LDAP search filter leading to authentication bypass	CWE-90

17 Jun 2026 10:48Current

5.4Medium risk

Vulners AI Score5.4

CVSS 3.14.3

EPSS0.01027

SSVC

CWE-90