External risk intelligence

Yamcs Instance Configuration Injection Leads to Remote Command Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-55559

Yamcs is a mission control framework that exposes management APIs (POST /api/instances) over the network. Because these endpoints facilitate instance management and configuration, they are typically exposed in environments where remote control or administrative interaction is required, making them common targets for network-based access.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the Yamcs mission control framework allows unauthenticated attackers to execute commands with the service account's privileges by injecting malicious code into configuration files. This could lead to unauthorized system access and control if exploited. The main concern is confirming relevance and exposure within your deployments.

Unescaped input allows command execution.
Critical flaw impacts system integrity.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could start by interacting with the Yamcs mission control framework over the network. By sending specially crafted data to the `/api/instances` or `/api/instances/{instance}` endpoints, an attacker could inject commands into YAML configurations. If successful, this could allow the attacker to execute arbitrary commands on the system with the privileges of the Yamcs service account.

Requires network access to Yamcs.
Triggered by API requests with crafted arguments.
Allows arbitrary command execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to inject commands that execute with the privileges of the Yamcs service account. This could occur when an instance is created or updated, and the impact depends on the deployment's security configuration. When supported by the advisory, unauthenticated users could exploit this on deployments without a security.yaml file, while authenticated users with instance creation privileges could exploit it on secured deployments.

Service account and system access.
Injecting commands via API requests.
Execute arbitrary commands on the system.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability resides within the Yamcs mission control framework, suggesting that platform teams responsible for managing the core infrastructure and application owners who deploy and configure Yamcs instances are the primary stakeholders. The initial crucial step involves identifying all Yamcs deployments across the environment, assessing their network exposure and operational criticality, and locating the designated owner for each instance to coordinate the remediation efforts.

Platform and application owners should lead remediation.
Verify Yamcs instance reachability and criticality.
Plan coordinated updates or configuration hardening.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Yamcs?

Yamcs is a mission control framework used to monitor, control, and manage complex systems, often in aerospace or high-precision environments. It provides core infrastructure for data processing and instance management, allowing operators to oversee real-time telemetry and command streams.

How does CVE-2026-55559 work?

This vulnerability involves improper control of generation of code, specifically using the CWE-94, CWE-470, and CWE-1336 weakness classes. The application fails to properly sanitize input before incorporating it into YAML configuration files. Because this input is not escaped, an attacker can inject malicious code—such as commands to start unauthorized processes—directly into the system's configuration logic.

Does sending any API request trigger this vulnerability?

No. The issue is specifically triggered by injecting malicious input into the `templateArgs` field within POST or PATCH requests to the `/api/instances` endpoints. Standard API calls that do not include crafted, injection-prone parameters will not trigger the flaw.

Why should I worry about Yamcs network exposure?

Halo Surface Signal indicates that because Yamcs management APIs are designed for remote control and administration, they are frequently reachable over the network. If your instance is internet-facing or accessible to unauthorized segments of your internal network, the risk is higher, as an attacker could interact with these management endpoints directly.

How do I secure my Yamcs installation?

The primary response is to update your software to version 5.12.8 or 5.13.2, which contain the necessary fixes to prevent improper YAML injection. Before updating, verify whether your deployment uses a security.yaml file to enforce authentication, as unprotected deployments without this file are significantly more vulnerable to unauthenticated access.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.