CVE-2026-55511Critical· 9.1▾ AbyssalPoC availableYamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs allows a user with SystemPrivilege.ControlArchiving to create a double-quoted StreamSQL column name that is interpolated into generated Java source by Expression.fil…
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 50.1 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Aug 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.7%
Last analysed / modified upstream
1 GitHub repo
Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs allows a user with SystemPrivilege.ControlArchiving to create a double-quoted StreamSQL column name that is interpolated into generated Java source by Expression.fillCode_InputDefVars and Expression.sanitizeName. A sum aggregate reaches yamcs-core/src/main/java/org/yamcs/yarch/streamsql/CompilableAggregateExpression.java and yamcs-core/src/main/java/org/yamcs/yarch/streamsql/funct/SumExpression.java through SelectExpression.compile, where Janino SimpleCompiler.cook compiles the injected source. POST /api/archive/{instance}:executeSql can therefore execute arbitrary Java in the Yamcs server process, exposing mission data and credentials and permitting telemetry tampering or denial of service. This issue is fixed in versions 5.12.8 and 5.13.2.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
org.yamcs:yamcs-core >= 5.13.0, <= 5.13.1org.yamcs:yamcs-core <= 5.12.7Patched in:
org.yamcs:yamcs-core 5.13.2org.yamcs:yamcs-core 5.12.8Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-55559Critical· 9.8Yamcs is a mission control framework
CVE-2026-55565Critical· 9.9Yamcs is a mission control framework
CVE-2026-55566Medium· 4.3Yamcs is a mission control framework
CVE-2026-55521High· 8.8Yamcs is a mission control framework
CVE-2026-55545Medium· 6.5Yamcs is a mission control framework
CVE-2026-55547Medium· 4.3Yamcs is a mission control framework