CVE-2026-55511 in Yamcs
Summary
by MITRE • 08/28/2026
Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs allows a user with SystemPrivilege.ControlArchiving to create a double-quoted StreamSQL column name that is interpolated into generated Java source by Expression.fillCode_InputDefVars and Expression.sanitizeName. A sum aggregate reaches yamcs-core/src/main/java/org/yamcs/yarch/streamsql/CompilableAggregateExpression.java and yamcs-core/src/main/java/org/yamcs/yarch/streamsql/funct/SumExpression.java through SelectExpression.compile, where Janino SimpleCompiler.cook compiles the injected source. POST /api/archive/{instance}:executeSql can therefore execute arbitrary Java in the Yamcs server process, exposing mission data and credentials and permitting telemetry tampering or denial of service. This issue is fixed in versions 5.12.8 and 5.13.2.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/28/2026
Yamcs serves as a critical mission control framework widely utilized for managing space missions and other complex operational systems, where the integrity and confidentiality of telemetry data are paramount. A severe security vulnerability was identified within versions prior to 5.12.8 and 5.13.2 that allows an authenticated user possessing SystemPrivilege.ControlArchiving privileges to execute arbitrary Java code on the Yamcs server process. This flaw stems from a critical input validation failure in how StreamSQL column names are processed during query compilation, specifically affecting the interaction between SQL parsing logic and the Janino expression compiler used for dynamic code generation.
The technical root cause lies in the handling of double-quoted identifiers within StreamSQL queries. When a user submits a POST request to /api/archive/{instance}:executeSql with a specially crafted column name enclosed in double quotes, this input is passed through Expression.fillCode_InputDefVars and Expression.sanitizeName without adequate sanitization or escaping. The vulnerable code path leads the malicious string into CompilableAggregateExpression.java and SumExpression.java via SelectExpression.compile. These components ultimately feed the unsanitized input directly into Janino SimpleCompiler.cook, which compiles Java source code at runtime. Because the framework assumes that quoted identifiers are safe to embed as variable names or literals in generated Java snippets, an attacker can inject arbitrary Java syntax by carefully crafting a column name that breaks out of its intended context and executes within the compiled class body.
This vulnerability constitutes a Remote Code Execution (RCE) flaw with significant operational impact on mission-critical infrastructure. By exploiting this issue, an adversary gains full control over the Yamcs server process running under the privileges of the application user. This level of access allows for the exfiltration of sensitive mission data and stored credentials, as well as the modification or deletion of telemetry streams. Furthermore, attackers can manipulate real-time operational parameters, potentially leading to incorrect decision-making by ground controllers or causing a denial of service through resource exhaustion or system crashes induced by malformed execution paths. The ability to execute arbitrary code effectively bypasses all application-level security controls within Yamcs, rendering authentication and authorization mechanisms ineffective against this specific attack vector.
From a classification perspective, this vulnerability aligns with CWE-94 Improper Control of Generation of Code (Code Injection) due the injection of executable Java source into a runtime compiler. It also maps to MITRE ATT&CK technique T1059 Command and Scripting Interpreter, specifically within the context of dynamic code execution environments like JVM-based applications where scripting languages or expression evaluators are used for flexibility but lack strict sandboxing. The attack vector is classified as Network Accessible with Low Complexity, requiring only valid authentication credentials at a specific privilege level rather than complex exploitation steps.
Mitigation strategies must prioritize immediate patching to version 5.12.8 or 5.13.2 where this input validation flaw has been addressed by properly sanitizing and escaping user-supplied identifiers before they are incorporated into generated Java source code. In environments where upgrading is not immediately feasible, network-level controls should be implemented to restrict access to the /api/archive endpoint exclusively to trusted internal networks or highly privileged administrative accounts with multi-factor authentication enabled. Additionally, deploying a Web Application Firewall (WAF) capable of detecting SQL injection patterns and unusual string lengths in query parameters can provide an additional layer of defense against exploitation attempts while permanent fixes are deployed. Regular security audits focusing on dynamic code generation components are recommended to prevent similar vulnerabilities in other parts of the framework.