CVE-2026-55559 yamcs CVE debrief

Who should care

Yamcs administrators, developers, and users who have access to the guest superuser or SystemPrivilege.CreateInstances should assess their exposure and prioritize upgrading to a fixed version.

Why it matters

CVE-2026-55559 is a critical vulnerability in Yamcs that allows for command injection, enabling an attacker to execute commands as the Yamcs service account. This issue is particularly concerning for deployments where the guest superuser has access or SystemPrivilege.CreateInstances is granted. The vulnerability is fixed in versions 5.12.8 and 5.13.2, and upgrading to one of these versions is crucial to prevent exploitation.

• Command injection as the Yamcs service account
• Potential for lateral movement within the system
• Need for verification of current Yamcs version and exposure
• Prioritization of upgrading to fixed versions 5.12.8 or 5.13.2

Technical summary

The Yamcs mission control framework is vulnerable to command injection due to insufficient YAML-context escaping when processing templateArgs in POST /api/instances and PATCH /api/instances/{instance} requests. This allows an attacker to inject a services entry for org.yamcs.ProcessRunner, leading to command execution as the Yamcs service account. The vulnerability is addressed in versions 5.12.8 and 5.13.2.

Defensive priority

High priority should be given to upgrading Yamcs to versions 5.12.8 or 5.13.2, especially in deployments where the guest superuser has access or SystemPrivilege.CreateInstances is granted.

Recommended defensive actions

• Upgrade Yamcs to version 5.12.8 or 5.13.2
• Review and restrict access to POST /api/instances and PATCH /api/instances/{instance}
• Ensure security.yaml is properly configured and secured
• Monitor for suspicious activity related to the Yamcs service account
• Perform vulnerability scanning to identify potentially exposed instances
• Implement additional logging and monitoring for instances with guest superuser access or SystemPrivilege.CreateInstances
• Review and update incident response plans to address potential exploitation

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability, its impact, and fixed versions. GitHub commits and releases confirm the fixes in versions 5.12.8 and 5.13.2. Evidence is limited to public statements from official sources without access to proprietary details. Defenders should verify current Yamcs versions, review access controls for POST /api/instances and PATCH /api/instances/{instance}, and ensure security.yaml is properly configured and secured.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.