CVE-2026-44596 is a medium severity flaw (CVSS 6.5) in Yamcs, a mission control framework. The login endpoint has no rate limiting or lockout, so an unauthenticated attacker can guess passwords without limit. Upgrade to Yamcs 5.12.7 on the 5.12 line, or 5.13.0.
What's affected
From the project advisory for the org.yamcs:yamcs-core Maven package:
- Affected: before 5.12.7 on the 5.12 line, and before 5.13.0.
- Fixed: 5.12.7 and 5.13.0.
The endpoint concerned is the token endpoint used for password logins. The advisory notes that neither the quickstart nor the documentation mentions throttling, so default installations have none.
How to check if you're exposed
Check the Yamcs version in your deployment, in the web interface or by looking at the jar names or dependency tree:
mvn dependency:tree -Dincludes=org.yamcs:yamcs-core
Then check who can reach the HTTP port, and whether any accounts use weak or reused passwords.
What to do now
- Upgrade to Yamcs 5.12.7 or 5.13.0.
- Put rate limiting in front of the HTTP port, for example in a reverse proxy.
- Do not expose the Yamcs interface to the internet.
- Review authentication logs for long runs of failed logins, and make sure passwords are strong.
Why it matters
The class is CWE-307 (improper restriction of excessive authentication attempts). Without a limit, an attacker can try as many passwords as the network allows, and the advisory shows twenty attempts finishing in a fraction of a second.
The impact is limited by the quality of the passwords, which is why the severity is medium. Mission control systems are sensitive, though, so treat it seriously. The record does not mark this CVE as KEV.
Quick check
Does a strong password make this safe?
It lowers the risk a great deal, but the fix still matters, since unlimited guessing helps against weak or reused passwords.
Sources
Last reviewed: 19 October 2026.
