CVE-2026-55559: Yamcs vulnerable to Remote Code Execution via instance-template argument YAML injection (createInstance)
templateArgs sent to POST /api/instances (and PATCH /api/instances/{instance}) are written into the rendered instance config as raw text, then parsed as YAML and loaded. Yamcs instantiates each services: entry by its class:, so injecting YAML through a template arg lets you add a services: entry for org.yamcs.ProcessRunner and run a command on the host. The args aren’t escaped for YAML or validated server-side.
Needs the CreateInstances privilege. With no security.yaml the guest user is superuser=true and the API is unauthenticated, so it’s reachable without auth, same default exposure as CVE-2026-46562. The 5.12.7 algorithm-edit fix doesn’t touch this path.
References
- github.com/advisories/GHSA-73mf-m39p-wpm9
- github.com/yamcs/yamcs/commit/549f295cf8c5496a5e799d6bec2432ef976c82aa
- github.com/yamcs/yamcs/commit/7192da1c49bdf5ab1d72e579a47766a7c43e87c8
- github.com/yamcs/yamcs/releases/tag/yamcs-5.12.8
- github.com/yamcs/yamcs/releases/tag/yamcs-5.13.2
- github.com/yamcs/yamcs/security/advisories/GHSA-73mf-m39p-wpm9
- nvd.nist.gov/vuln/detail/CVE-2026-55559
Code Behaviors & Features
Detect and mitigate CVE-2026-55559 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →