Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Yamcs can be tricked into running commands on your server

CVE-2026-55559 · published 6 days ago
Summary

Older versions of the Yamcs mission control system let a specially crafted web request add malicious configuration data. That data can cause Yamcs to start a process that runs any command it wants, using the same account that runs the Yamcs software, effectively giving an attacker control of the server. Upgrade Yamcs to version 5.12.8 or later (or 5.13.2 for newer releases) and limit who can create or modify instances to prevent this.

Original advisory text
Yamcs: Remote Code Execution via instance-template argument YAML injection (createInstance)
Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs inserts templateArgs from POST /api/instances and PATCH /api/instances/{instance} into YAML through VarStatement.append in yamcs-core/src/main/java/org/yamcs/templating/VarStatement.java without YAML-context escaping. The rendered configuration is parsed by YamcsServer.createInstance and loaded by YamcsServerInstance, allowing an attacker to inject a services entry for org.yamcs.ProcessRunner. Deployments without security.yaml expose the operation through the guest superuser, while secured deployments require SystemPrivilege.CreateInstances. Successful exploitation executes commands as the Yamcs service account. This issue is fixed in versions 5.12.8 and 5.13.2.
References
Severity
9.8 Critical
CVSS 3.1: 9.8 (OSV)
Exploitation
EPSS <1%
Type
CWE-1336Improper Neutralization of Special Elements Used in a Template Engine
CWE-470Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
CWE-94Code Injection
Timeline
Published28 Aug 2026
Updated2 Sep 2026
First seen30 Aug 2026
Sources
CVE-2026-55559 · OSV
GHSA-73mf-m39p-wpm9 · GHSA
CVE-2026-55559 · NVD
Monitor software like this
Free during beta