CVE-2026-55511: falha crítica em yamcs
Yamcs: Authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql`
Publicada em · Atualizada em
48Vexday Risk Score
Sem sinal de exploração. Ela tem prova de conceito pública.
ssvc Attendcvss 9.1epss 0.7%
da publicação à arma0 dias
Publicada no NVD28 de ago.
1ª PoC15 de jul.
probabilidade de exploração
0.7%top 48% das CVEs
exploração observada
nãonenhuma fonte reporta
1 exploit(s) público(s)
Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs allows a user with SystemPrivilege.ControlArchiving to create a double-quoted StreamSQL column name that is interpolated into generated Java source by Expression.fillCode_InputDefVars and Expression.sanitizeName. A sum aggregate reaches yamcs-core/src/main/java/org/yamcs/yarch/streamsql/CompilableAggregateExpression.java and yamcs-core/src/main/java/org/yamcs/yarch/streamsql/funct/SumExpression.java through SelectExpression.compile, where Janino SimpleCompiler.cook compiles the injected source. POST /api/archive/{instance}:executeSql can therefore execute arbitrary Java in the Yamcs server process, exposing mission data and credentials and permitting telemetry tampering or denial of service. This issue is fixed in versions 5.12.8 and 5.13.2.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Produtos afetados
yamcs · yamcsPoCs públicas encontradas — 1
githubgithub.com/junfuture1103/CVE-2026-55511★ 1⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — yamcs
No mesmo produto, das mais perigosas para as menos.
CVE-2026-44596MEDIUMYamcs: No Rate Limiting on Authentication EndpointEPSS 2.1%CVE-2026-55552HIGHYamcs: Unauthenticated Directory TraversalEPSS 1.7%CVE-2026-55549MEDIUMYamcs: Reflected XSS in the URL of the Authorize EndpointEPSS 1.3%CVE-2026-46621CRITICALYamcs: Authenticated Remote Code Execution (RCE) via Jython Algorithm Code InjectionEPSS 1.1%CVE-2026-44632CRITICALYamcs: Server-Side Code Injection (RCE) via Janino Expression Engine in `JavaExprAlgorithmExecutionFactory`EPSS 1.1%CVE-2026-44595MEDIUMYamcs: Unauthorized user enumeration via IAM API endpointsEPSS 1.1%
Referências
https://github.com/yamcs/yamcs/commit/8c1070b12c0a6c003903325cb2a1013347e2dbdehttps://github.com/yamcs/yamcs/commit/b65a3d78178ba99a58b753feda6ecc3b5a694f13https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.8https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.2https://github.com/yamcs/yamcs/security/advisories/GHSA-3g44-3m7x-cgg2