CVE-2026-55565

Yamcs, an open-source mission control framework used for spacecraft and ground-segment operations, inserts an unescaped LIKE pattern into Java source code that it compiles and executes at runtime, allowing a quote character in the pattern to inject arbitrary Java (CWE-94). The flaw is reachable through the archive SQL endpoints (POST /api/archive/{instance}:executeSql, POST /api/archive/{instance}:streamSql, POST /api/archive/{instance}/tables/{table}:readRows), the events search endpoint (GET /api/archive/{instance}/events), and activity searches, and requires only low privileges such as ReadTables, ReadEvents, or ReadActivities. By embedding a quote in a LIKE pattern supplied via one of these endpoints, an attacker can execute code with the privileges of the Yamcs server process, with high impact on confidentiality, integrity, and availability (CVSS 9.9). All deployments running versions prior to 5.12.8 or prior to 5.13.2 are affected. As of now there is no evidence of exploitation in the wild, no known public proof-of-concept, and the issue is not in CISA's KEV; EPSS estimates a 0.5% probability of exploitation within 30 days.

What to do: Upgrade Yamcs to 5.12.8 or 5.13.2 as soon as possible. Until patched, restrict the affected archive SQL, table-read, events, and activity-search API endpoints to trusted authenticated accounts, and review which users hold ReadTables, ReadEvents, or ReadActivities permissions. Prioritize patching any Yamcs instances exposed to untrusted networks, since the flaw is network-reachable with low privileges and full RCE impact.