Yamcs Authentication Endpoint Brute-Force Vulnerability

Technical Analysis

CVE-2026-44596 affects the POST /auth/token endpoint in yamcs-core, implemented in AuthHandler.java, which processes authentication requests without any throttling, rate limiting, or failed-attempt lockout controls. This design flaw allows an unauthenticated attacker to send unlimited login attempts against any known username, enabling credential brute-forcing at scale, particularly against weak or default passwords. The vulnerability does not require prior access or user interaction, lowering the barrier for exploitation, though it requires knowledge of valid usernames to be effective. If Yamcs is deployed as a backend service for satellite or spacecraft telemetry systems that interface with AI-driven automation or agent-based mission control tools, successful credential compromise could expose API tokens or session credentials used by those agents to authenticate against Yamcs, potentially allowing an attacker to manipulate agent-driven command sequences or exfiltrate mission telemetry data.

Affected Systems

Yamcs (yamcs-core) versions prior to 5.12.7 and prior to 5.13.0; specifically the AuthHandler.java implementation of the POST /auth/token endpoint used for authentication in mission control deployments.

Indicators of Compromise

• No specific IOCs published; detection should focus on abnormal volume of POST /auth/token requests from a single source IP or against a single username in Yamcs server logs.

Remediation Steps

1. 1

   Upgrade Yamcs

   Update to Yamcs version 5.12.7 or 5.13.0 or later, which include rate limiting and account lockout protections on the authentication endpoint.

2. 2

   Implement network-level rate limiting

   If immediate patching is not possible, deploy a reverse proxy or WAF in front of the Yamcs instance to enforce rate limiting and IP-based throttling on /auth/token requests.

3. 3

   Monitor authentication logs

   Enable logging and alerting for repeated failed login attempts against the /auth/token endpoint to detect brute-force activity in progress.

4. 4

   Enforce strong password policies

   Require complex passwords and, where supported, multi-factor authentication for all Yamcs user accounts to reduce brute-force success likelihood.

5. 5

   Restrict network exposure

   Limit access to the Yamcs authentication endpoint to trusted networks or VPNs rather than exposing it directly to the internet.