CVE-2026-55559

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-55559
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55559.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-55559
Aliases
Published
2026-08-28T17:22:07Z
Modified
2026-10-28T11:14:57Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Yamcs: Remote Code Execution via instance-template argument YAML injection (createInstance)
Details

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs inserts templateArgs from POST /api/instances and PATCH /api/instances/{instance} into YAML through VarStatement.append in yamcs-core/src/main/java/org/yamcs/templating/VarStatement.java without YAML-context escaping. The rendered configuration is parsed by YamcsServer.createInstance and loaded by YamcsServerInstance, allowing an attacker to inject a services entry for org.yamcs.ProcessRunner. Deployments without security.yaml expose the operation through the guest superuser, while secured deployments require SystemPrivilege.CreateInstances. Successful exploitation executes commands as the Yamcs service account. This issue is fixed in versions 5.12.8 and 5.13.2.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-1336",
        "CWE-470",
        "CWE-94"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55559.json"
}
References

Affected packages

Git / github.com/yamcs/yamcs

Affected ranges

Type
GIT
Repo
https://github.com/yamcs/yamcs
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
144335f15d7730d7fc833122c8c8a6f1906fea9f
Introduced
8bf5af6fe227bbf8ead15e60644b7ddbf345d623
Fixed
50d73a44d136f0dd2828fa11f69f1fe1fc5583f7
Fixed
549f295cf8c5496a5e799d6bec2432ef976c82aa
Fixed
7192da1c49bdf5ab1d72e579a47766a7c43e87c8
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "5.12.8"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "introduced":  "5.13.0"
                },
                {
                    "fixed":  "5.13.2"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "fixed":  "549f295cf8c5496a5e799d6bec2432ef976c82aa"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "7192da1c49bdf5ab1d72e579a47766a7c43e87c8"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "yamcs-5.12.8",
            "range":  [
                {
                    "fixed":  "144335f15d7730d7fc833122c8c8a6f1906fea9f"
                }
            ],
            "source":  "REFERENCES_TAG"
        },
        {
            "original_tag":  "yamcs-5.13.2",
            "range":  [
                {
                    "fixed":  "50d73a44d136f0dd2828fa11f69f1fe1fc5583f7"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

Other
before-removing-cfdp-half-implemented-features
v0.*
v0.26.0
v0.26.1
v0.28.0
v0.28.0-20150811
v0.28.0-20150817
v0.28.0-20150820
v0.28.0-20150824
v0.28.0-20150825
v0.28.0-20150826
v0.28.0-20150827
v0.28.0-20150828
v0.28.0-20150901
v0.28.0-20150902
v0.28.0-20150902-2
v0.28.0-20150903
v0.29.0
v0.29.1
v0.29.1-20151214
v0.29.1-20160119
v0.29.1-20160127
v0.29.3
v0.29.3-20160608
v0.29.4
yamcs-0.*
yamcs-0.30.0
yamcs-3.*
yamcs-3.0.0
yamcs-3.1.0
yamcs-3.1.1
yamcs-3.1.2
yamcs-3.2.0
yamcs-3.2.1
yamcs-3.2.2
yamcs-3.3.0
yamcs-3.4.0
yamcs-4.*
yamcs-4.0.1
yamcs-4.1.1
yamcs-4.1.2
yamcs-4.10.0
yamcs-4.10.1
yamcs-4.10.2
yamcs-4.10.3
yamcs-4.10.4
yamcs-4.10.5
yamcs-4.10.6
yamcs-4.10.7
yamcs-4.10.8
yamcs-4.10.9
yamcs-4.2.0
yamcs-4.2.1
yamcs-4.2.2
yamcs-4.3.0
yamcs-4.3.1
yamcs-4.4.0
yamcs-4.4.1
yamcs-4.4.2
yamcs-4.7
yamcs-4.7.1
yamcs-4.7.2
yamcs-4.7.3
yamcs-4.8.0
yamcs-4.8.1
yamcs-4.9.0
yamcs-4.9.1
yamcs-4.9.2
yamcs-4.9.3
yamcs-4.9.4
yamcs-4.9.5
yamcs-5.*
yamcs-5.0.0
yamcs-5.0.1
yamcs-5.1.0
yamcs-5.1.1
yamcs-5.1.2
yamcs-5.1.3
yamcs-5.10.0
yamcs-5.10.1
yamcs-5.10.2
yamcs-5.10.3
yamcs-5.10.4
yamcs-5.10.5
yamcs-5.10.6
yamcs-5.10.7
yamcs-5.10.8
yamcs-5.10.9
yamcs-5.11.0
yamcs-5.11.1
yamcs-5.11.2
yamcs-5.11.3
yamcs-5.11.4
yamcs-5.11.5
yamcs-5.11.6
yamcs-5.11.7
yamcs-5.12.0
yamcs-5.12.1
yamcs-5.12.2
yamcs-5.12.3
yamcs-5.12.4
yamcs-5.12.5
yamcs-5.12.6
yamcs-5.12.7
yamcs-5.13.0
yamcs-5.13.1
yamcs-5.2.0
yamcs-5.3.0
yamcs-5.3.1
yamcs-5.3.2
yamcs-5.3.3
yamcs-5.3.4
yamcs-5.3.5
yamcs-5.4.0
yamcs-5.4.1
yamcs-5.4.2
yamcs-5.4.3
yamcs-5.5.0
yamcs-5.5.1
yamcs-5.5.2
yamcs-5.5.3
yamcs-5.5.4
yamcs-5.5.5
yamcs-5.5.6
yamcs-5.5.7
yamcs-5.6.0
yamcs-5.6.1
yamcs-5.6.2
yamcs-5.7.0
yamcs-5.7.1
yamcs-5.7.10
yamcs-5.7.2
yamcs-5.7.3
yamcs-5.7.4
yamcs-5.7.5
yamcs-5.7.6
yamcs-5.7.7
yamcs-5.7.8
yamcs-5.7.9
yamcs-5.8.0
yamcs-5.8.1
yamcs-5.8.2
yamcs-5.8.3
yamcs-5.8.4
yamcs-5.8.5
yamcs-5.8.6
yamcs-5.8.7
yamcs-5.8.8
yamcs-5.9.0
yamcs-5.9.1
yamcs-5.9.2
yamcs-5.9.3
yamcs-5.9.4
yamcs-5.9.5
yamcs-5.9.6
yamcs-5.9.7
yamcs-5.9.8

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55559.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "153067512387360800640650782148040722651",
                "191804111690748979115485529669918333538",
                "28889612609946952130228007245207544228",
                "240309738183701125070129169337930881968",
                "92002191716445636332538620119808487817",
                "269764362240470094455824471162237550622",
                "250788547044662430552661547438462511696"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-55559-0c695ec7",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/yamcs/yamcs/commit/549f295cf8c5496a5e799d6bec2432ef976c82aa",
        "target":  {
            "file":  "yamcs-core/src/test/java/org/yamcs/templating/TemplateProcessorTest.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "127785365575722409122843830542993423339",
                "254465432962126326056942083840613365836",
                "198719224167475927841861992080116595012",
                "255868016540439736662177578118305909462"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-55559-1f985264",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/yamcs/yamcs/commit/7192da1c49bdf5ab1d72e579a47766a7c43e87c8",
        "target":  {
            "file":  "yamcs-core/src/main/java/org/yamcs/YamcsServer.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "295935030010123244066028650221939066562",
                "87127763653182131812497613387874326819",
                "98594006278310587815421783935599200812",
                "273594766749328604618752663671924518150",
                "121789078965729063440869263813773347023",
                "160798808901466710907156587569024105719",
                "20405446628155673761725222749529141848"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-55559-29f3c379",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/yamcs/yamcs/commit/7192da1c49bdf5ab1d72e579a47766a7c43e87c8",
        "target":  {
            "file":  "yamcs-core/src/main/java/org/yamcs/templating/Template.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "295935030010123244066028650221939066562",
                "87127763653182131812497613387874326819",
                "98594006278310587815421783935599200812",
                "273594766749328604618752663671924518150",
                "121789078965729063440869263813773347023",
                "160798808901466710907156587569024105719",
                "20405446628155673761725222749529141848"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-55559-557ad43f",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/yamcs/yamcs/commit/549f295cf8c5496a5e799d6bec2432ef976c82aa",
        "target":  {
            "file":  "yamcs-core/src/main/java/org/yamcs/templating/Template.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "174179456100683167793661743940593080312",
                "116723593473414150532100570865585992979",
                "26255908239546468879754498908142698279",
                "287562435159124547679286933729358110174",
                "139112561612282333706499910189119848652",
                "201189174631893166725819844048324822645",
                "186755406996263542145914747680246601157",
                "188692755309651967632917708264320308774",
                "94121970277426271079288988602883740177"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-55559-5711f030",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/yamcs/yamcs/commit/549f295cf8c5496a5e799d6bec2432ef976c82aa",
        "target":  {
            "file":  "yamcs-core/src/main/java/org/yamcs/templating/TemplateProcessor.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "174179456100683167793661743940593080312",
                "116723593473414150532100570865585992979",
                "26255908239546468879754498908142698279",
                "287562435159124547679286933729358110174",
                "139112561612282333706499910189119848652",
                "201189174631893166725819844048324822645",
                "186755406996263542145914747680246601157",
                "188692755309651967632917708264320308774",
                "94121970277426271079288988602883740177"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-55559-83427e67",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/yamcs/yamcs/commit/7192da1c49bdf5ab1d72e579a47766a7c43e87c8",
        "target":  {
            "file":  "yamcs-core/src/main/java/org/yamcs/templating/TemplateProcessor.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "127785365575722409122843830542993423339",
                "254465432962126326056942083840613365836",
                "198719224167475927841861992080116595012",
                "255868016540439736662177578118305909462"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-55559-ec630da9",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/yamcs/yamcs/commit/549f295cf8c5496a5e799d6bec2432ef976c82aa",
        "target":  {
            "file":  "yamcs-core/src/main/java/org/yamcs/YamcsServer.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "153067512387360800640650782148040722651",
                "191804111690748979115485529669918333538",
                "28889612609946952130228007245207544228",
                "240309738183701125070129169337930881968",
                "92002191716445636332538620119808487817",
                "269764362240470094455824471162237550622",
                "250788547044662430552661547438462511696"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-55559-f94bc293",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/yamcs/yamcs/commit/7192da1c49bdf5ab1d72e579a47766a7c43e87c8",
        "target":  {
            "file":  "yamcs-core/src/test/java/org/yamcs/templating/TemplateProcessorTest.java"
        }
    }
]
vanir_signatures_modified 
"2026-10-28T11:14:57Z"