CVE-2026-62329
validatedZero produced an exploit or a check.description
Yamcs Core deployments before 5.13.6 may create a local superuser account during startup when the internal user directory is empty, even when external authentication is configured. An unauthenticated remote party could use that account to obtain administrative control if the login interface is reachable.
mitigation
Upgrade org.yamcs:yamcs-core to version 5.13.6. Until upgraded, restrict remote access to the Yamcs login interface and verify that no default local administrator account remains active.
fixed in 5.13.6
outcome
Differential: the exploit fired on the vulnerable build and stayed silent on the patched one.
source signals
Public signals that triggered or updated the pipeline. These are inputs for the deltas above.
- 2026-10-01 10:47Zghsa: trigger signal, started the run
this entry in the feed
GET /api/v1/feed/CVE-2026-62329
{ "etk_id": "ETK-2026-349", "cve_id": "CVE-2026-62329", "display_id": "CVE-2026-62329", "ghsa_id": "GHSA-p8gv-cph3-5746", "euvd_id": null, "status": "published", "anchor_state": "awaiting_cve", "title": "Default administrative credentials in Yamcs core", "summary": "Yamcs Core deployments before 5.13.6 may create a local superuser account during startup when the internal user directory is empty, even when external authentication is configured. An unauthenticated remote party could use that account to obtain administrative control if the login interface is reachable.", "mitigation": "Upgrade `org.yamcs:yamcs-core` to version 5.13.6. Until upgraded, restrict remote access to the Yamcs login interface and verify that no default local administrator account remains active.", "vendor": "maven", "product": "maven:org.yamcs:yamcs-core", "affected": [ { "affected_notes": [], "affected_ranges": [ "< 5.13.6" ], "ecosystem": "maven", "fixed_versions": [ "5.13.6" ], "package_name": "org.yamcs:yamcs-core", "purl": "pkg:maven/org.yamcs/yamcs-core" } ], "cwes": [ 1392 ], "cvss_score": 9.8, "cvss_src": "cna_vendor", "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "epss_score": null, "epss_percentile": null, "epss_asof": null, "automation": "deterministic", "check": true, "check_confidence_basis": "differential", "exploit": true, "pipeline_minutes": 9.1138621, "t0_at": null, "signals": { "check": { "at": "2026-11-06T12:48:38.378972+00:00", "days": -1.3648708903703703, "is_lower_bound": true, "measured_at": "2026-11-07T21:34:03.262228+00:00", "url": null }, "exploit": { "at": "2026-11-06T12:48:38.378972+00:00", "days": -1.3648708903703703, "is_lower_bound": true, "measured_at": "2026-11-07T21:34:03.262228+00:00", "url": null }, "trigger_signal": { "at": "2026-10-01T10:47:25+00:00", "days": -37.44905351736111, "is_lower_bound": true, "measured_at": "2026-11-07T21:34:03.262228+00:00", "url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-p8gv-cph3-5746" } } }
published 2026-10-02 15:27Z
last change 2026-11-07 21:21Z
Need the technical details behind an entry?
Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.