← News
/DISPATCH · 2026-08-31

Yamcs Mission Control YAML Injection RCE CVE-2026-55559: Space and Critical Infrastructure Mission Control Faces Unauthorized Remote Takeover

Yamcs before 5.12.8/5.13.2 concatenates templateArgs into YAML config unsanitized. Attackers inject arbitrary YAML to trigger parse and RCE. Public PoC exists. CVSS 9.8 Critical.

In late August 2026, Yamcs (org.yamcs:yamcs-core), an open-source framework for space mission control and critical infrastructure telemetry, disclosed high-severity RCE CVE-2026-55559. CVSS 9.8 Critical. Affects all versions before Yamcs 5.12.8 and 5.13.2. 5.12.8 / 5.13.2 ship the fix. Type is CWE-20 Improper Input Validation. Root cause: Yamcs concatenates user-controlled templateArgs into YAML strings during internal YAML template rendering with no escaping. A parameter value with special characters injects arbitrary YAML structure.

Vulnerability Principle and Attack Path

When loading mission parameter packets, Yamcs looks up config by template name and merges templateArgs into the target YAML. Injected YAML is loaded server-side by parsers such as SnakeYAML, triggering deserialization and arbitrary class instantiation, then arbitrary Java code execution. Attack vectors include any client interface that can send parameters to Yamcs: mission scheduling channels, parameter upload APIs, ops consoles. Public PoC appeared shortly after disclosure; one-click, very low complexity. CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H.

Space and Critical Infrastructure Exposure

Yamcs is used by ESA, national space agencies, satellite operators, ground stations, deep-space programs, and energy, water, grid critical-infrastructure telemetry. In typical spacecraft ops, Yamcs handles command uplink, parameter downlink, alert dispatch, and automated script execution. Compromise of one Yamcs node in a mission control system lets an attacker forge command uplink to on-orbit spacecraft—tampering with orbit control, payload switches, attitude maneuvers—or forge downlink telemetry, distorting ground assessment of spacecraft health. In energy, grid, and SCADA, Yamcs nodes often sit as telemetry aggregation and alert ingress; compromise can couple directly into OT control systems.

Impact Assessment

Yamcs is widely used in ESA mission control, satellite ground stations, deep-space, and critical infrastructure telemetry for real-time command dispatch, parameter up/downlink, alerts, and state management. This bug gives any low-privilege user who can reach Yamcs code execution on the underlying mission control system. Direct threat to on-orbit spacecraft, critical infrastructure, and downstream systems that depend on Yamcs telemetry. Public PoC exists; user base is high-sensitivity industry. NCSC-FI and others listed it CRITICAL in 30 August threat intel summaries. Act immediately.

Fix and Mitigation

Preferred: upgrade to Yamcs 5.12.8 or 5.13.2.

If you cannot upgrade immediately:

Detection: anomalous YAML parse errors in Yamcs logs; unexpected class instantiation during SnakeYAML load; parameter upload from untrusted segments; unexpected shell children spawned by the Yamcs process.

References