CVE-2026-55549: Yamcs Mission Control Framework XSS Vulnerability

CVE-2026-55549 Overview

CVE-2026-55549 is a reflected cross-site scripting (XSS) vulnerability in Yamcs, an open-source mission control framework used to operate spacecraft and other remote systems. Versions prior to 5.9.4 fail to properly HTML-escape the redirect_uri parameter reflected from GET /auth/authorize into the authorize.html template. An attacker who convinces a Yamcs user to open a crafted authorization URL can execute arbitrary JavaScript in the victim's browser session. The injected script can access browser-held authentication material and exfiltrate it, enabling full account compromise. The issue is tracked as [CWE-79] and is fixed in Yamcs 5.9.4.

Critical Impact
Successful exploitation allows theft of authentication tokens from an authenticated Yamcs operator, leading to account takeover of mission control accounts.

Affected Products

Yamcs mission control framework versions prior to 5.9.4
yamcs-core component (AuthHandler.java, HandlerContext.java, authorize.html)
Deployments exposing the /auth/authorize endpoint to user-reachable networks

Discovery Timeline

2026-08-28 - CVE-2026-55549 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-55549

Vulnerability Analysis

The vulnerability exists in the OAuth-style authorization flow exposed by Yamcs. When a client issues GET /auth/authorize, the AuthHandler extracts the redirect_uri query parameter and passes it into the Pebble-style template yamcs-core/src/main/resources/auth/templates/authorize.html. The template rendering path invoked from HandlerContext.java writes the value into the HTML response without escaping angle brackets, quotes, or ampersands. An attacker controls the exact string reflected into the page, which enables injection of <script> tags or event handler attributes.

Because the affected endpoint sits inside the authentication flow, the target user is typically already logged in when they visit the crafted link. The injected script executes in the origin of the Yamcs web console and can read tokens or session identifiers held in browser storage, then transmit them to an attacker-controlled endpoint.

Root Cause

The root cause is missing output encoding in the templating engine used by Yamcs. Template variables were rendered as raw strings with no default filter applied. The fix introduces an EscapeFilter that applies HTML entity encoding to string variables and threads a filter map through the render pipeline (including IfStatement.render) so that all reflected variables are escaped by default.

Attack Vector

Exploitation requires user interaction: the victim must click or otherwise load a crafted URL such as https://<yamcs-host>/auth/authorize?redirect_uri=<payload>&client_id=.... No authentication is required to craft the request, but the payload executes in the browser of any user who follows the link. The attack is delivered over the network and has low complexity.

java

// Patch: yamcs-core/src/main/java/org/yamcs/templating/EscapeFilter.java
package org.yamcs.templating;

/**
 * Escapes HTML in a string.
 */
public class EscapeFilter implements VariableFilter {

    @Override
    public Object applyFilter(Object variable) {
        if (variable instanceof String) {
            return ((String) variable)
                    .replace("&", "&")
                    .replace("<", "<")
                    .replace(">", ">")
                    .replace("'", "'")
                    .replace("\"", """);
        }

        return variable;
    }
}
// Source: https://github.com/yamcs/yamcs/commit/4d47d5cdcf5d92c2c5bbbc19feada422923332e3

Detection Methods for CVE-2026-55549

Indicators of Compromise

Requests to /auth/authorize containing <, >, ", ', or script substrings inside the redirect_uri parameter
Outbound browser requests from authenticated Yamcs operators to unfamiliar domains shortly after clicking authorization links
Access log entries where redirect_uri does not match a registered client callback URL

Detection Strategies

Inspect HTTP access logs for the Yamcs web tier and flag /auth/authorize requests containing URL-encoded XSS payloads such as %3Cscript or onerror=
Deploy a Content Security Policy (CSP) in report-only mode to surface inline script violations originating from the authorize page
Compare the redirect_uri parameter against an allowlist of registered callback URIs and alert on mismatches

Monitoring Recommendations

Monitor Yamcs authentication endpoints with a Web Application Firewall (WAF) tuned for reflected XSS payloads
Correlate authentication events with subsequent API calls from new IP addresses or user agents to detect token replay
Alert on Yamcs versions below 5.9.4 discovered by asset inventory or software composition analysis

How to Mitigate CVE-2026-55549

Immediate Actions Required

Upgrade all Yamcs deployments to version 5.9.4 or later, which introduces the EscapeFilter HTML encoding fix
Rotate any authentication tokens or session credentials that may have been exposed to users who followed untrusted authorization links
Restrict network exposure of the Yamcs web interface to trusted operator networks or a VPN

Patch Information

The fix is available in the Yamcs 5.9.4 release. Details of the security advisory are published as GHSA-rxpg-wjf8-qv9c, and the code change is available in the upstream commit. The patch adds an EscapeFilter variable filter and updates the template rendering pipeline (including IfStatement.render) to apply the filter automatically to string variables.

Workarounds

Place a reverse proxy or WAF in front of Yamcs that rejects redirect_uri values containing HTML metacharacters until patching is complete
Enforce a strict Content Security Policy that disallows inline scripts on the /auth/authorize response
Train operators to avoid clicking authorization URLs received from untrusted sources

bash

# Example nginx snippet to block XSS payloads in redirect_uri until patched
location /auth/authorize {
    if ($arg_redirect_uri ~* "(<|>|script|onerror|onload|javascript:)") {
        return 400;
    }
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'" always;
    proxy_pass http://yamcs_backend;
}