CVE-2026-55559

Yamcs, an open-source mission control framework, prior to versions 5.12.8 and 5.13.2 interpolates templateArgs from POST /api/instances and PATCH /api/instances/{instance} into YAML configuration via VarStatement.append without YAML-context escaping, enabling YAML injection. An attacker sends crafted template arguments that inject a services entry for org.yamcs.ProcessRunner, which is then parsed by YamcsServer.createInstance and loaded by YamcsServerInstance, executing attacker-supplied commands as the Yamcs service account. On deployments without security.yaml the operation is exposed through the guest superuser (no authentication), while secured deployments require the SystemPrivilege.CreateInstances privilege. All Yamcs deployments running affected versions are impacted, with internet-exposed instances lacking authentication facing the highest risk (CVSS 9.8). No public proof-of-concept or in-the-wild exploitation is known (not in CISA KEV; EPSS ~0.6%).

What to do: Upgrade to Yamcs 5.12.8 (5.12 series) or 5.13.2 (5.13 series) as soon as possible. Until patched, restrict network access to the Yamcs API, enforce authentication by not exposing the guest superuser (deploy and enforce security.yaml), and limit CreateInstances privileges to trusted roles. Also audit existing instance configurations for unexpected org.yamcs.ProcessRunner service entries that could indicate prior exploitation.