CVE-2026-62329

{
  "etk_id": "ETK-2026-349",
  "cve_id": "CVE-2026-62329",
  "display_id": "CVE-2026-62329",
  "ghsa_id": "GHSA-p8gv-cph3-5746",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Default administrative credentials in Yamcs core",
  "summary": "Yamcs core can create a privileged local administrator account with known initial credentials when the internal user store has no users. An unauthenticated remote attacker who can reach the login service may obtain administrative access; configuring an external authentication provider alone does not prevent this condition.",
  "mitigation": "Upgrade org.yamcs:yamcs-core to version 5.13.6 or later. Until upgraded, restrict access to the Yamcs login service and ensure the internal user store is not left empty with its initial administrator credentials active.",
  "vendor": "maven",
  "product": "maven:org.yamcs:yamcs-core",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "< 5.13.6"
      ],
      "ecosystem": "maven",
      "fixed_versions": [
        "5.13.6"
      ],
      "package_name": "org.yamcs:yamcs-core",
      "purl": "pkg:maven/org.yamcs/yamcs-core"
    }
  ],
  "cwes": [
    1392
  ],
  "cvss_score": 9.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 14.824310966666667,
  "t0_at": null,
  "signals": {
    "trigger_signal": {
      "at": "2026-10-01T10:47:25+00:00",
      "days": -20.25983574434028,
      "is_lower_bound": true,
      "measured_at": "2026-10-21T17:01:34.831544+00:00",
      "url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-p8gv-cph3-5746"
    }
  }
}