{"id":"CVE-2026-55559","summary":"Yamcs: Remote Code Execution via instance-template argument YAML injection (createInstance)","details":"Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs inserts templateArgs from POST /api/instances and PATCH /api/instances/{instance} into YAML through VarStatement.append in yamcs-core/src/main/java/org/yamcs/templating/VarStatement.java without YAML-context escaping. The rendered configuration is parsed by YamcsServer.createInstance and loaded by YamcsServerInstance, allowing an attacker to inject a services entry for org.yamcs.ProcessRunner. Deployments without security.yaml expose the operation through the guest superuser, while secured deployments require SystemPrivilege.CreateInstances. Successful exploitation executes commands as the Yamcs service account. This issue is fixed in versions 5.12.8 and 5.13.2.","aliases":["GHSA-73mf-m39p-wpm9"],"modified":"2026-09-10T08:13:52.599739Z","published":"2026-08-28T17:22:07.633Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55559.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-1336","CWE-470","CWE-94"]},"references":[{"type":"WEB","url":"https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.8"},{"type":"WEB","url":"https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55559.json"},{"type":"ADVISORY","url":"https://github.com/yamcs/yamcs/security/advisories/GHSA-73mf-m39p-wpm9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55559"},{"type":"FIX","url":"https://github.com/yamcs/yamcs/commit/549f295cf8c5496a5e799d6bec2432ef976c82aa"},{"type":"FIX","url":"https://github.com/yamcs/yamcs/commit/7192da1c49bdf5ab1d72e579a47766a7c43e87c8"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/yamcs/yamcs","events":[{"introduced":"0"},{"introduced":"8bf5af6fe227bbf8ead15e60644b7ddbf345d623"},{"fixed":"144335f15d7730d7fc833122c8c8a6f1906fea9f"},{"fixed":"50d73a44d136f0dd2828fa11f69f1fe1fc5583f7"},{"fixed":"549f295cf8c5496a5e799d6bec2432ef976c82aa"},{"fixed":"7192da1c49bdf5ab1d72e579a47766a7c43e87c8"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"5.12.8"},{"introduced":"5.13.0"},{"fixed":"5.13.2"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["yamcs-5.13.1","yamcs-5.13.0","yamcs-5.12.7","yamcs-5.12.6","yamcs-5.12.5","yamcs-5.12.4","yamcs-5.12.3","yamcs-5.12.2","yamcs-5.12.1","yamcs-5.12.0","yamcs-5.11.7","yamcs-5.9.8","yamcs-5.11.6","yamcs-5.11.5","yamcs-5.11.4","yamcs-5.10.9","yamcs-5.11.3","yamcs-5.11.2","yamcs-5.11.1","yamcs-5.11.0","yamcs-5.10.8","yamcs-5.10.7","yamcs-5.10.6","yamcs-5.10.5","yamcs-5.10.4","yamcs-5.10.3","yamcs-5.10.2","yamcs-5.10.1","yamcs-5.10.0","yamcs-5.9.7","yamcs-5.9.6","yamcs-5.9.5","yamcs-5.9.4","yamcs-5.9.3","yamcs-5.9.2","yamcs-5.9.1","yamcs-5.9.0","yamcs-5.8.8","yamcs-5.8.7","yamcs-5.8.6","yamcs-5.8.5","yamcs-5.8.4","yamcs-5.8.3","yamcs-5.8.2","yamcs-5.8.0","yamcs-5.8.1","yamcs-5.7.10","yamcs-5.7.9","yamcs-5.7.8","yamcs-5.7.7","yamcs-5.7.6","yamcs-5.7.5","yamcs-5.7.4","yamcs-5.7.3","yamcs-5.7.2","yamcs-5.7.1","yamcs-5.7.0","yamcs-5.6.2","yamcs-5.5.7","yamcs-5.6.1","yamcs-5.6.0","yamcs-5.5.6","before-removing-cfdp-half-implemented-features","yamcs-5.5.5","yamcs-5.5.4","yamcs-5.5.3","yamcs-5.5.2","yamcs-5.5.1","yamcs-5.5.0","yamcs-5.3.5","yamcs-5.4.3","yamcs-5.4.2","yamcs-5.4.1","yamcs-5.4.0","yamcs-5.2.0","yamcs-5.3.4","yamcs-5.3.3","yamcs-5.3.2","yamcs-5.3.1","yamcs-5.3.0","yamcs-5.1.3","yamcs-5.1.2","yamcs-5.1.1","yamcs-5.1.0","yamcs-5.0.1","yamcs-5.0.0","yamcs-4.10.9","yamcs-4.10.8","yamcs-4.10.7","yamcs-4.10.6","yamcs-4.10.5","yamcs-4.10.4","yamcs-4.10.3","yamcs-4.10.2","yamcs-4.10.1","yamcs-4.10.0","yamcs-4.9.5","yamcs-4.9.4","yamcs-4.9.3","yamcs-4.9.2","yamcs-4.9.1","yamcs-4.9.0","yamcs-4.8.1","yamcs-4.8.0","yamcs-4.7.3","yamcs-4.7.2","yamcs-4.7.1","yamcs-4.7","yamcs-4.4.2","yamcs-4.4.1","yamcs-4.4.0","yamcs-4.3.1","yamcs-4.3.0","yamcs-4.2.2","yamcs-4.2.1","yamcs-4.2.0","yamcs-4.1.2","yamcs-4.1.1","yamcs-4.0.1","yamcs-3.4.0","yamcs-3.3.0","yamcs-3.2.2","yamcs-3.2.1","yamcs-3.2.0","yamcs-3.1.2","yamcs-3.1.1","yamcs-3.1.0","yamcs-3.0.0","yamcs-0.30.0","v0.29.4","v0.29.3-20160608","v0.29.3","v0.29.1","v0.29.1-20160127","v0.29.1-20160119","v0.29.1-20151214","v0.29.0","v0.28.0","v0.28.0-20150903","v0.28.0-20150902-2","v0.28.0-20150902","v0.28.0-20150901","v0.28.0-20150828","v0.28.0-20150827","v0.28.0-20150826","v0.28.0-20150825","v0.28.0-20150824","v0.28.0-20150820","v0.28.0-20150817","v0.28.0-20150811","v0.26.1","v0.26.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55559.json","vanir_signatures_modified":"2026-09-10T08:13:52Z","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/549f295cf8c5496a5e799d6bec2432ef976c82aa","target":{"file":"yamcs-core/src/test/java/org/yamcs/templating/TemplateProcessorTest.java"},"deprecated":false,"digest":{"line_hashes":["153067512387360800640650782148040722651","191804111690748979115485529669918333538","28889612609946952130228007245207544228","240309738183701125070129169337930881968","92002191716445636332538620119808487817","269764362240470094455824471162237550622","250788547044662430552661547438462511696"],"threshold":0.9},"id":"CVE-2026-55559-0c695ec7","signature_type":"Line"},{"id":"CVE-2026-55559-1f985264","signature_type":"Line","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/7192da1c49bdf5ab1d72e579a47766a7c43e87c8","target":{"file":"yamcs-core/src/main/java/org/yamcs/YamcsServer.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["127785365575722409122843830542993423339","254465432962126326056942083840613365836","198719224167475927841861992080116595012","255868016540439736662177578118305909462"]}},{"signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/7192da1c49bdf5ab1d72e579a47766a7c43e87c8","target":{"file":"yamcs-core/src/main/java/org/yamcs/templating/Template.java"},"deprecated":false,"digest":{"line_hashes":["295935030010123244066028650221939066562","87127763653182131812497613387874326819","98594006278310587815421783935599200812","273594766749328604618752663671924518150","121789078965729063440869263813773347023","160798808901466710907156587569024105719","20405446628155673761725222749529141848"],"threshold":0.9},"id":"CVE-2026-55559-29f3c379","signature_type":"Line"},{"target":{"file":"yamcs-core/src/main/java/org/yamcs/templating/Template.java"},"deprecated":false,"digest":{"line_hashes":["295935030010123244066028650221939066562","87127763653182131812497613387874326819","98594006278310587815421783935599200812","273594766749328604618752663671924518150","121789078965729063440869263813773347023","160798808901466710907156587569024105719","20405446628155673761725222749529141848"],"threshold":0.9},"id":"CVE-2026-55559-557ad43f","signature_type":"Line","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/549f295cf8c5496a5e799d6bec2432ef976c82aa"},{"digest":{"line_hashes":["174179456100683167793661743940593080312","116723593473414150532100570865585992979","26255908239546468879754498908142698279","287562435159124547679286933729358110174","139112561612282333706499910189119848652","201189174631893166725819844048324822645","186755406996263542145914747680246601157","188692755309651967632917708264320308774","94121970277426271079288988602883740177"],"threshold":0.9},"id":"CVE-2026-55559-5711f030","signature_type":"Line","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/549f295cf8c5496a5e799d6bec2432ef976c82aa","target":{"file":"yamcs-core/src/main/java/org/yamcs/templating/TemplateProcessor.java"},"deprecated":false},{"digest":{"line_hashes":["174179456100683167793661743940593080312","116723593473414150532100570865585992979","26255908239546468879754498908142698279","287562435159124547679286933729358110174","139112561612282333706499910189119848652","201189174631893166725819844048324822645","186755406996263542145914747680246601157","188692755309651967632917708264320308774","94121970277426271079288988602883740177"],"threshold":0.9},"id":"CVE-2026-55559-83427e67","signature_type":"Line","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/7192da1c49bdf5ab1d72e579a47766a7c43e87c8","target":{"file":"yamcs-core/src/main/java/org/yamcs/templating/TemplateProcessor.java"},"deprecated":false},{"id":"CVE-2026-55559-ec630da9","signature_type":"Line","signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/549f295cf8c5496a5e799d6bec2432ef976c82aa","target":{"file":"yamcs-core/src/main/java/org/yamcs/YamcsServer.java"},"deprecated":false,"digest":{"line_hashes":["127785365575722409122843830542993423339","254465432962126326056942083840613365836","198719224167475927841861992080116595012","255868016540439736662177578118305909462"],"threshold":0.9}},{"signature_version":"v1","source":"https://github.com/yamcs/yamcs/commit/7192da1c49bdf5ab1d72e579a47766a7c43e87c8","target":{"file":"yamcs-core/src/test/java/org/yamcs/templating/TemplateProcessorTest.java"},"deprecated":false,"digest":{"line_hashes":["153067512387360800640650782148040722651","191804111690748979115485529669918333538","28889612609946952130228007245207544228","240309738183701125070129169337930881968","92002191716445636332538620119808487817","269764362240470094455824471162237550622","250788547044662430552661547438462511696"],"threshold":0.9},"id":"CVE-2026-55559-f94bc293","signature_type":"Line"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}