CVE-2026-55565: Yamcs Mission Control Framework RCE Vulnerability

CVE-2026-55565 Overview

CVE-2026-55565 is a code injection vulnerability [CWE-94] in Yamcs, an open-source mission control framework used for spacecraft and satellite operations. Versions prior to 5.12.8 and 5.13.2 embed unescaped user-supplied LIKE patterns directly into Java source code that is compiled at runtime through SimpleCompiler.cook. An authenticated attacker with ReadTables, ReadEvents, or ReadActivities permissions can inject Java code via a crafted quote character in a LIKE pattern. The injected code executes with the privileges of the Yamcs server process.

Critical Impact
Authenticated attackers can achieve remote code execution as the Yamcs server process by submitting a crafted LIKE pattern to archive, table, event, or activity search endpoints.

Affected Products

Yamcs versions prior to 5.12.8
Yamcs versions prior to 5.13.2 in the 5.13.x branch
Deployments exposing POST /api/archive/{instance}:executeSql, POST /api/archive/{instance}:streamSql, POST /api/archive/{instance}/tables/{table}:readRows, GET /api/archive/{instance}/events, or activity search paths

Discovery Timeline

2026-08-28 - CVE-2026-55565 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-55565

Vulnerability Analysis

The flaw resides in LikeExpression.fillCode_getValueReturn within yamcs-core/src/main/java/org/yamcs/yarch/streamsql/LikeExpression.java. Yamcs implements StreamSQL evaluation by generating Java source at runtime and compiling it with Janino's SimpleCompiler.cook. When building code for a LIKE clause, the vulnerable method concatenates the user-supplied pattern directly into a Java string literal without escaping.

A quote character in the pattern terminates the generated string literal and lets the attacker append arbitrary Java statements. The compiled expression runs inside the Yamcs JVM, granting the attacker the same privileges as the Yamcs server process. This turns a low-privilege authenticated request into full server-side code execution.

Root Cause

The root cause is missing input escaping when embedding untrusted data into dynamically generated source code. The class ValueExpression already exposed an escapeJavaString helper, but LikeExpression did not invoke it. Because the visibility of escapeJavaString was private, it was also unreachable from sibling expression classes. The classification [CWE-94] Improper Control of Generation of Code applies directly.

Attack Vector

An attacker requires valid Yamcs credentials with any privilege that permits SQL-style queries or search filters. Reachable endpoints include archive SQL execution, table row reads, event queries, and activity searches. The attacker submits a LIKE pattern containing a double-quote character followed by Java code that breaks out of the generated string literal.

java

// Patched code in LikeExpression.java
// Source: https://github.com/yamcs/yamcs/commit/640e1598b7097b521692e89dd47a39b6cb1fc663
        code.append("org.yamcs.yarch.streamsql.Utils.like(");
        children[0].fillCode_getValueReturn(code);
        code.append(", \"");
-       code.append(likeClause.pattern);
+       ValueExpression.escapeJavaString(likeClause.pattern, code);
        code.append("\")");
    }

java

// Patched visibility change in ValueExpression.java
// Source: https://github.com/yamcs/yamcs/commit/640e1598b7097b521692e89dd47a39b6cb1fc663
-   private void escapeJavaString(String str, StringBuilder sb) {
+   static void escapeJavaString(String str, StringBuilder sb) {
        int sz;
        sz = str.length();
        for (int i = 0; i < sz; i++) {

Detection Methods for CVE-2026-55565

Indicators of Compromise

Yamcs process spawning unexpected child processes such as sh, bash, cmd.exe, powershell.exe, or utilities like curl and wget.
Outbound network connections initiated by the Yamcs JVM to non-mission control hosts.
HTTP request bodies to /api/archive/{instance}:executeSql, :streamSql, /tables/{table}:readRows, /events, or activity search endpoints containing LIKE clauses with embedded " characters or Java syntax fragments.
New or modified class files in the Yamcs working directory that were not deployed by the operator.

Detection Strategies

Inspect application access logs for LIKE operators whose right-hand-side literal contains a raw double quote, backslash, or the tokens ); or Runtime.getRuntime.
Correlate authenticated Yamcs API calls with process-execution telemetry from the underlying host to catch code-execution side effects.
Alert on any SimpleCompiler or Janino compilation error events in Yamcs server logs, which frequently indicate malformed injection attempts.

Monitoring Recommendations

Baseline the child-process tree of the Yamcs JVM and alert on deviations using host EDR telemetry.
Enable audit logging on all /api/archive/* endpoints and forward events to a centralized SIEM for retention and query.
Monitor egress traffic from mission control servers, which normally communicate only with defined ground-segment components.

How to Mitigate CVE-2026-55565

Immediate Actions Required

Upgrade Yamcs to version 5.12.8 or 5.13.2, which apply escaping via ValueExpression.escapeJavaString before compilation.
Rotate credentials for any account that holds ReadTables, ReadEvents, or ReadActivities permissions on an unpatched instance.
Review authentication logs and API access history for suspicious LIKE queries preceding the upgrade.

Patch Information

Upstream fixes are available in the Yamcs 5.12.8 release and the Yamcs 5.13.2 release. The commits 640e1598 and a8fb4a06 route the LIKE pattern through ValueExpression.escapeJavaString before it is embedded in generated Java source. Full details are published in GitHub Security Advisory GHSA-c64q-hj4j-375f.

Workarounds

Restrict ReadTables, ReadEvents, and ReadActivities roles to trusted operators until the patch is deployed.
Place Yamcs API endpoints behind a reverse proxy that rejects request bodies containing double quotes inside LIKE clauses.
Run the Yamcs server as an unprivileged system user inside a container or sandbox to limit the blast radius of code execution.

bash

# Verify installed Yamcs version and confirm it is patched
yamcsadmin version
# Expected: 5.12.8, 5.13.2, or later

# Example reverse-proxy rule (nginx) to block suspicious LIKE payloads
# location /api/archive/ {
#     if ($request_body ~* "LIKE[^\"]*\"[^\"]*\\\"") { return 403; }
#     proxy_pass http://yamcs_backend;
# }