CVE-2026-55559: Yamcs Mission Control Framework RCE Vulnerability

CVE-2026-55559 Overview

CVE-2026-55559 is a code injection vulnerability in Yamcs, an open-source mission control framework used for space and ground systems operations. The flaw exists in the templating engine, where templateArgs supplied through POST /api/instances and PATCH /api/instances/{instance} are inserted into YAML configuration without context-aware escaping. An attacker who can reach the instance-management API can inject a services entry referencing org.yamcs.ProcessRunner, causing the Yamcs server to execute arbitrary commands as the Yamcs service account. The issue affects versions prior to 5.12.8 and 5.13.2 and is tracked under CWE-94: Improper Control of Generation of Code.

Critical Impact
Successful exploitation yields remote command execution as the Yamcs service account, enabling full takeover of the mission control host.

Affected Products

Yamcs mission control framework versions prior to 5.12.8
Yamcs mission control framework versions prior to 5.13.2
Deployments without security.yaml (guest superuser exposes the endpoint without authentication)

Discovery Timeline

2026-08-28 - CVE-2026-55559 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-55559

Vulnerability Analysis

Yamcs supports templated instance definitions rendered from user-supplied templateArgs. The rendering path passes attacker-controlled strings through VarStatement.append in yamcs-core/src/main/java/org/yamcs/templating/VarStatement.java and writes the result directly into a YAML configuration file. Because values are not escaped for YAML context, an attacker can break out of the intended scalar and inject new mapping keys.

The rendered file is then consumed by YamcsServer.createInstance and loaded through YamcsServerInstance. Injecting a services block that references org.yamcs.ProcessRunner results in Yamcs launching an arbitrary process on startup of the new instance. Commands run under the Yamcs service account, granting the attacker the same access as the mission control daemon.

Root Cause

The root cause is missing YAML-context escaping when substituting template variables. Template output is trusted as structured YAML rather than treated as untrusted scalar content, allowing injection of arbitrary mapping keys and values into the final configuration document.

Attack Vector

The vulnerability is exploitable over the network via the Yamcs REST API. In deployments without security.yaml, the guest superuser exposes the instance-creation operation without authentication. In secured deployments, an attacker must hold SystemPrivilege.CreateInstances. In both cases, exploitation requires no user interaction.

java

// Patch: yamcs-core/src/main/java/org/yamcs/YamcsServer.java
// Route template rendering through YAML-aware sanitization
        metadata.setLabels(labels);
        customMetadata.forEach((k, v) -> metadata.put(k, v));

-        String processed = template.process(metadata.getTemplateArgs());
+        String processed = template.processAndSanitizeYaml(metadata.getTemplateArgs());

        Path confFile = instanceDefDir.resolve(configFileName(name));
        try (Writer writer = Files.newBufferedWriter(confFile)) {
// Source: https://github.com/yamcs/yamcs/commit/549f295cf8c5496a5e799d6bec2432ef976c82aa

The companion change in Template.java introduces snakeyaml and helper utilities used by the new processAndSanitizeYaml method to safely serialize template argument values.

Detection Methods for CVE-2026-55559

Indicators of Compromise

Yamcs instance configuration files containing unexpected services: entries referencing org.yamcs.ProcessRunner with attacker-controlled command arguments.
Child processes of the Yamcs JVM that are not part of the documented mission profile, particularly shells, network utilities, or interpreters.
API access logs showing POST /api/instances or PATCH /api/instances/{instance} requests with templateArgs values containing newline characters, colons, or YAML control tokens.

Detection Strategies

Inspect rendered instance configuration files under the Yamcs instance definition directory for services entries that were not present in the source template.
Compare deployed configuration files against version-controlled templates to identify injected mapping keys.
Alert on any invocation of org.yamcs.ProcessRunner on hosts where mission logic does not require external process execution.

Monitoring Recommendations

Enable authentication by configuring security.yaml and audit any use of the guest account for instance-management endpoints.
Log and review all requests to /api/instances including request bodies, source IPs, and identity of the calling principal.
Monitor process ancestry on Yamcs hosts to catch unexpected child processes spawned by the Yamcs service account.

How to Mitigate CVE-2026-55559

Immediate Actions Required

Upgrade Yamcs to version 5.12.8 or 5.13.2 (or later) as published in the Yamcs 5.12.8 release and Yamcs 5.13.2 release.
Deploy a security.yaml configuration to disable guest superuser access and require authenticated principals for all API operations.
Restrict SystemPrivilege.CreateInstances to a minimal set of trusted administrative accounts.

Patch Information

The fix is delivered in commits 549f295 and 7192da1. Both replace the direct call to template.process(...) with template.processAndSanitizeYaml(...), which serializes template argument values through snakeyaml before they are written to the instance configuration file. Additional details are available in the GHSA-73mf-m39p-wpm9 advisory.

Workarounds

Place the Yamcs API behind a reverse proxy or network ACL that restricts access to trusted operators only.
Disable or block the /api/instances endpoints at the proxy layer until the upgrade is applied.
Run the Yamcs process under a dedicated, least-privileged service account with no ability to execute administrative utilities on the host.

bash

# Verify installed Yamcs version and upgrade to a fixed release
yamcsd --version

# Example: enforce authentication by creating security.yaml
cat > etc/security.yaml <<'EOF'
accessControl:
  - class: org.yamcs.security.UsernamePasswordAuthModule
unknownUserBehavior: DENY
EOF

# Restart Yamcs after applying the upgrade and configuration
systemctl restart yamcs