CVE-2026-55511

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs allows a user with SystemPrivilege.ControlArchiving to create a double-quoted StreamSQL column name that is interpolated into generated Java source by Expression.fillCode_InputDefVars and Expression.sanitizeName. A sum aggregate reaches yamcs-core/src/main/java/org/yamcs/yarch/streamsql/CompilableAggregateExpression.java and yamcs-core/src/main/java/org/yamcs/yarch/streamsql/funct/SumExpression.java through SelectExpression.compile, where Janino SimpleCompiler.cook compiles the injected source. POST /api/archive/{instance}:executeSql can therefore execute arbitrary Java in the Yamcs server process, exposing mission data and credentials and permitting telemetry tampering or denial of service. This issue is fixed in versions 5.12.8 and 5.13.2.

• CWE-94

• https://github.com/yamcs/yamcs/commit/8c1070b12c0a6c003903325cb2a1013347e2dbde
• https://github.com/yamcs/yamcs/commit/b65a3d78178ba99a58b753feda6ecc3b5a694f13
• https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.8
• https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.2
• https://github.com/yamcs/yamcs/security/advisories/GHSA-3g44-3m7x-cgg2
• https://github.com/yamcs/yamcs/security/advisories/GHSA-3g44-3m7x-cgg2

Published

Aug 28, 2026

Last Modified

Sep 8, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-555009Router is an AI router & token saver. Prior to 0.4.80, the …9.9
• CVE-2026-555019Router is an AI router & token saver. Prior to 0.4.80, the …7.3
• CVE-2026-55502Cloudreve is a self-hosted file management and sharing syste…7.1
• CVE-2026-55509WsgiDAV is a generic and extendable WebDAV server based on W…8.8
• CVE-2026-5551A security flaw has been discovered in itsourcecode Free Hot…7.3
• CVE-2026-55510ImageMagick is free and open-source software used for editin…5.5
• CVE-2026-55512nebula-mesh is a self-hosted control plane for Slack Nebula …5.3
• CVE-2026-55513nebula-mesh is a self-hosted control plane for Slack Nebula …5.4
• CVE-2026-55514vLLM is a library for LLM inference and serving. From 0.12.0…6.5
• CVE-2026-55515Snipe-IT is an IT asset/license management system. Prior to …5
• CVE-2026-55516Snipe-IT is an IT asset/license management system. Prior to …7.7
• CVE-2026-55517Deno is a JavaScript, TypeScript, and WebAssembly runtime. P…4.3