CVE-2026-55511

Received Received - Intake

SQL Injection via StreamSQL in Yamcs Mission Control

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: GitHub, Inc.

Description

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs allows a user with SystemPrivilege.ControlArchiving to create a double-quoted StreamSQL column name that is interpolated into generated Java source by Expression.fillCode_InputDefVars and Expression.sanitizeName. A sum aggregate reaches yamcs-core/src/main/java/org/yamcs/yarch/streamsql/CompilableAggregateExpression.java and yamcs-core/src/main/java/org/yamcs/yarch/streamsql/funct/SumExpression.java through SelectExpression.compile, where Janino SimpleCompiler.cook compiles the injected source. POST /api/archive/{instance}:executeSql can therefore execute arbitrary Java in the Yamcs server process, exposing mission data and credentials and permitting telemetry tampering or denial of service. This issue is fixed in versions 5.12.8 and 5.13.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-28

Generated

2026-08-29

AI Q&A

2026-08-29

EPSS Evaluated

N/A

NVD

CVE-2026-55511

EUVD

EUVD-2026-67836

Affected Vendors & Products

Vendor	Product	Version / Range
yamcs	yamcs	to 5.12.8\|end_excluding=5.13.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

This vulnerability in Yamcs allows a user with ControlArchiving privilege to inject malicious StreamSQL column names that get converted into Java code. The injected code is compiled and executed by the Yamcs server, enabling arbitrary Java execution. This can lead to unauthorized access to mission data, credentials, and potential system compromise.

Detection Guidance

Check Yamcs server versions for 5.12.8 or 5.13.2 or higher. Inspect logs for suspicious SQL execution via POST /api/archive/{instance}:executeSql. Monitor for unexpected Java source compilation errors or arbitrary code execution patterns.

Impact Analysis

If exploited, this vulnerability could expose sensitive mission data and credentials, allow tampering with telemetry data, or cause denial of service. Attackers with the required privilege could gain control over the Yamcs server process, leading to significant operational and security risks.

Compliance Impact

This vulnerability could lead to unauthorized access or disclosure of sensitive data, violating GDPR's data protection principles and HIPAA's security and privacy requirements. Organizations using affected Yamcs versions may face compliance violations, legal penalties, and reputational damage.

Mitigation Strategies

Upgrade Yamcs to version 5.12.8 or 5.13.2 immediately. Restrict SystemPrivilege.ControlArchiving access to trusted users only. Disable or monitor POST /api/archive/{instance}:executeSql endpoints for unusual activity.

Hi! I’m here to help you understand CVE-2026-55511. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70