CVE-2026-55559: Yamcs vulnerable to Remote Code Execution via instance-template argument YAML injection (createInstance)
templateArgs sent to POST /api/instances (and PATCH /api/instances/{instance}) are written into the rendered instance config as raw text, then parsed as YAML and loaded. Yamcs instantiates each services: entry by its class:, so injecting YAML through a template arg lets you add a services: entry for org.yamcs.ProcessRunner and run a command on the host. The args aren’t escaped for YAML or validated server-side.
Needs the CreateInstances privilege. With no security.yaml the guest user is superuser=true and the API is unauthenticated, so it’s reachable without auth, same default exposure as CVE-2026-46562. The 5.12.7 algorithm-edit fix doesn’t touch this path.
References
- github.com/advisories/GHSA-73mf-m39p-wpm9
- github.com/yamcs/yamcs/commit/549f295cf8c5496a5e799d6bec2432ef976c82aa
- github.com/yamcs/yamcs/commit/7192da1c49bdf5ab1d72e579a47766a7c43e87c8
- github.com/yamcs/yamcs/releases/tag/yamcs-5.12.8
- github.com/yamcs/yamcs/releases/tag/yamcs-5.13.2
- github.com/yamcs/yamcs/security/advisories/GHSA-73mf-m39p-wpm9
- nvd.nist.gov/vuln/detail/CVE-2026-55559
Code Behaviors & Features
Detect and mitigate CVE-2026-55559 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →