CVE-2026-55559

Received Received - Intake

YAML Injection in Yamcs Mission Control Framework

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: GitHub, Inc.

Description

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs inserts templateArgs from POST /api/instances and PATCH /api/instances/{instance} into YAML through VarStatement.append in yamcs-core/src/main/java/org/yamcs/templating/VarStatement.java without YAML-context escaping. The rendered configuration is parsed by YamcsServer.createInstance and loaded by YamcsServerInstance, allowing an attacker to inject a services entry for org.yamcs.ProcessRunner. Deployments without security.yaml expose the operation through the guest superuser, while secured deployments require SystemPrivilege.CreateInstances. Successful exploitation executes commands as the Yamcs service account. This issue is fixed in versions 5.12.8 and 5.13.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-28

Generated

2026-08-29

AI Q&A

2026-08-29

EPSS Evaluated

N/A

NVD

CVE-2026-55559

EUVD

EUVD-2026-67843

Affected Vendors & Products

Vendor	Product	Version / Range
yamcs	yamcs	to 5.12.8\|end_excluding=5.13.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-470	The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-1336	The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.

Attack-Flow Graph

Executive Summary

This vulnerability in Yamcs allows attackers to inject malicious YAML code through the POST /api/instances and PATCH /api/instances/{instance} endpoints. The system fails to properly escape user-provided input when inserting it into YAML templates, enabling attackers to manipulate the YAML structure and inject a services entry for org.yamcs.ProcessRunner. This can lead to arbitrary command execution as the Yamcs service account.

Detection Guidance

Check Yamcs versions for affected releases (5.12.7 and earlier, 5.13.1 and earlier). Inspect API logs for POST /api/instances or PATCH /api/instances/{instance} requests containing YAML template arguments. Look for unusual services entries or ProcessRunner configurations in instance templates.

Impact Analysis

If exploited, this vulnerability allows attackers to execute arbitrary commands on the host system with the privileges of the Yamcs service account. This could lead to full system compromise, unauthorized access to sensitive data, tampering with telemetry or command history, and potential lateral movement within the network. The impact depends on the Yamcs service account permissions.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR (data breaches exposing personal data), HIPAA (unauthorized access to protected health information), and other regulations requiring data integrity and confidentiality. Successful exploitation may result in unauthorized data access, modification, or deletion, violating compliance requirements for data protection and security controls.

Mitigation Strategies

Upgrade Yamcs to versions 5.12.8 or 5.13.2 or later. If upgrading is not possible, disable the /api/instances endpoint or restrict access to trusted users. Review security.yaml to ensure proper authentication is enforced. Monitor for unauthorized service configurations or command executions.

Hi! I’m here to help you understand CVE-2026-55559. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70