CVE-2026-55511: Yamcs Mission Control Framework RCE Vulnerability

CVE-2026-55511 Overview

CVE-2026-55511 is a code injection vulnerability [CWE-94] in Yamcs, an open-source mission control framework used to operate spacecraft and other remote assets. Versions prior to 5.12.8 and 5.13.2 fail to sanitize double-quoted StreamSQL identifiers before interpolating them into dynamically generated Java source code. An authenticated user holding SystemPrivilege.ControlArchiving can craft a malicious column name that is compiled by the Janino SimpleCompiler.cook method, resulting in arbitrary Java execution inside the Yamcs server process. Successful exploitation exposes mission data and stored credentials, and allows telemetry tampering or denial of service against mission operations.

Critical Impact
An authenticated attacker with archive control privileges can achieve remote code execution in the Yamcs server process via POST /api/archive/{instance}:executeSql, exposing mission data, credentials, and enabling telemetry tampering.

Affected Products

Yamcs mission control framework versions prior to 5.12.8 (5.12.x branch)
Yamcs mission control framework versions prior to 5.13.2 (5.13.x branch)
Deployments exposing the POST /api/archive/{instance}:executeSql endpoint to users with SystemPrivilege.ControlArchiving

Discovery Timeline

2026-08-28 - CVE-2026-55511 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-55511

Vulnerability Analysis

Yamcs implements a StreamSQL dialect that compiles query expressions to Java source at runtime and then executes them using the Janino compiler. The grammar for S_DOUBLE_QUOTED_IDENTIFIER in StreamSql.jj accepted any character except newline, carriage return, or double quote inside a quoted identifier. That identifier was passed to Expression.fillCode_InputDefVars and Expression.sanitizeName, which embedded the string directly into generated Java source without validating characters against the identifier alphabet.

When a SUM aggregate is compiled, execution flows through SelectExpression.compile into CompilableAggregateExpression.java and SumExpression.java in the yamcs-core module. The Janino SimpleCompiler.cook call then compiles the attacker-controlled Java fragment, producing a class that executes arbitrary code with the privileges of the Yamcs server JVM.

Root Cause

The root cause is insufficient input validation on double-quoted identifiers in the StreamSQL lexer. The token rule permitted arbitrary characters, allowing curly braces, semicolons, and Java statements to survive into generated source. Because the compilation step trusted these identifiers as safe language tokens, the boundary between SQL data and Java code was lost.

Attack Vector

An authenticated user with SystemPrivilege.ControlArchiving sends a crafted StreamSQL query to POST /api/archive/{instance}:executeSql. The query includes a SUM aggregate whose column reference is a double-quoted identifier containing Java syntax. Yamcs compiles and executes the injected code inline with normal query processing. No user interaction is required, and the attack occurs over the network.

text

// StreamSql.jj lexer change (patch)
    < S_IDENTIFIER: (<LETTER>)+ (<DIGIT> | <LETTER> |<SPECIAL_CHARS>)* >
  | < #LETTER: ["a"-"z", "A"-"Z"] >
  | < #SPECIAL_CHARS: "$" | "_" | "#" | ".">
- | < S_DOUBLE_QUOTED_IDENTIFIER: "\"" (~["\n","\r","\""])* "\"" >
+ | < S_DOUBLE_QUOTED_IDENTIFIER: "\"" (<LETTER> | <DIGIT> | <SPECIAL_CHARS>)+ "\"" >
  | < S_QMARK: "?" >

Source: GitHub Commit Fix b65a3d7

Detection Methods for CVE-2026-55511

Indicators of Compromise

Requests to POST /api/archive/{instance}:executeSql containing double-quoted identifiers with non-alphanumeric characters such as {, }, ;, (, or ).
Unexpected child processes spawned by the Yamcs Java process, or new outbound network connections from the Yamcs server.
New or modified .class files, temporary Janino compilation artifacts, or unusual class loader activity in the Yamcs process working directory.
Audit log entries showing SystemPrivilege.ControlArchiving accounts running SUM aggregates over synthetic column names.

Detection Strategies

Enable and forward Yamcs application and audit logs to a central logging platform, then alert on executeSql requests whose SQL body contains suspicious identifier patterns.
Instrument the JVM with a Java agent or runtime application self-protection tooling to flag dynamic compilation calls made by janino.SimpleCompiler.
Monitor process ancestry so any subprocess descending from the Yamcs JVM (for example sh, bash, curl, python) is investigated.

Monitoring Recommendations

Track authentication and privilege assignment events for accounts granted SystemPrivilege.ControlArchiving and review scope periodically.
Baseline the volume and structure of StreamSQL queries per user and alert on deviations, particularly queries containing quoted identifiers.
Watch for unexpected changes to archived telemetry values or gaps in telemetry ingestion that could indicate post-exploitation tampering or denial of service.

How to Mitigate CVE-2026-55511

Immediate Actions Required

Upgrade Yamcs to version 5.12.8 (5.12.x branch) or 5.13.2 (5.13.x branch) as published in the GitHub Security Advisory GHSA-3g44-3m7x-cgg2.
Audit all users and roles that hold SystemPrivilege.ControlArchiving and revoke the privilege where it is not required.
Restrict network access to the Yamcs API so only trusted operator workstations can reach POST /api/archive/{instance}:executeSql.
Rotate any credentials, API tokens, or secrets stored on or accessible to the Yamcs host, since RCE exposes process memory and configuration.

Patch Information

The issue is fixed in Yamcs 5.12.8 and Yamcs 5.13.2. The fix, applied in commits 8c1070b and b65a3d7, tightens the S_DOUBLE_QUOTED_IDENTIFIER grammar rule so quoted identifiers accept only letters, digits, and the characters $, _, #, and ..

Workarounds

If immediate upgrade is not possible, remove SystemPrivilege.ControlArchiving from all users until patches are deployed.
Place the Yamcs API behind an authenticating reverse proxy that rejects requests to :executeSql containing suspicious identifier characters.
Run the Yamcs JVM under a least-privilege service account with restrictive filesystem and network policies to limit blast radius of any successful code execution.

bash

# Verify installed Yamcs version and upgrade to a fixed release
yamcsd --version

# For 5.12.x deployments, upgrade to 5.12.8 or later
# For 5.13.x deployments, upgrade to 5.13.2 or later
# Release artifacts: https://github.com/yamcs/yamcs/releases