MAVEN · AUGUST 2026 · EARLY WARNING

Yamcs Vulnerable to Authenticated RCE via StreamSQL Injection

EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.
Severity
HIGH
Affected component
yamcs-core (maven)
Affected versions
>= yamcs-5.12.6, <= yamcs-5.12.6 or >= yamcs-5.12.5, <= yamcs-5.12.5 or >= yamcs-5.12.4, <= yamcs-5.12.4 or >= yamcs-5.12.3, <= yamcs-5.12.3 or >= yamcs-5.12.2, <= yamcs-5.12.2 or >= yamcs-5.12.1, <= yamcs-5.12.1 or >= yamcs-5.12.0, <= yamcs-5.12.0 or >= yamcs-5.11.7, <= yamcs-5.11.7 or >= yamcs-5.9.8, <= yamcs-5.9.8 or >= yamcs-5.11.6, <= yamcs-5.11.6 or >= yamcs-5.11.5, <= yamcs-5.11.5 or >= yamcs-5.11.4, <= yamcs-5.11.4 or >= yamcs-5.10.9, <= yamcs-5.10.9 or >= yamcs-5.11.3, <= yamcs-5.11.3 or >= yamcs-5.11.2, <= yamcs-5.11.2 or >= yamcs-5.11.1, <= yamcs-5.11.1 or >= yamcs-5.11.0, <= yamcs-5.11.0 or >= yamcs-5.10.8, <= yamcs-5.10.8 or >= yamcs-5.10.7, <= yamcs-5.10.7 or >= yamcs-5.10.6, <= yamcs-5.10.6 or >= yamcs-5.10.5, <= yamcs-5.10.5 or >= yamcs-5.10.4, <= yamcs-5.10.4 or >= yamcs-5.10.3, <= yamcs-5.10.3 or >= yamcs-5.10.2, <= yamcs-5.10.2 or >= yamcs-5.10.1, <= yamcs-5.10.1 or >= yamcs-5.10.0, <= yamcs-5.10.0 or >= yamcs-5.9.7, <= yamcs-5.9.7 or >= yamcs-5.9.6, <= yamcs-5.9.6 or >= yamcs-5.9.5, <= yamcs-5.9.5 or >= yamcs-5.9.4, <= yamcs-5.9.4 or >= yamcs-5.9.3, <= yamcs-5.9.3 or >= yamcs-5.9.2, <= yamcs-5.9.2 or >= yamcs-5.9.1, <= yamcs-5.9.1 or >= yamcs-5.9.0, <= yamcs-5.9.0 or >= yamcs-5.8.8, <= yamcs-5.8.8 or >= yamcs-5.8.7, <= yamcs-5.8.7 or >= yamcs-5.8.6, <= yamcs-5.8.6 or >= yamcs-5.8.5, <= yamcs-5.8.5 or >= yamcs-5.8.4, <= yamcs-5.8.4 or >= yamcs-5.8.3, <= yamcs-5.8.3 or >= yamcs-5.8.2, <= yamcs-5.8.2 or >= yamcs-5.8.0, <= yamcs-5.8.0 or >= yamcs-5.8.1, <= yamcs-5.8.1 or >= yamcs-5.7.10, <= yamcs-5.7.10 or >= yamcs-5.7.9, <= yamcs-5.7.9 or >= yamcs-5.7.8, <= yamcs-5.7.8 or >= yamcs-5.7.7, <= yamcs-5.7.7 or >= yamcs-5.7.6, <= yamcs-5.7.6 or >= yamcs-5.7.5, <= yamcs-5.7.5 or >= yamcs-5.7.4, <= yamcs-5.7.4 or >= yamcs-5.7.3, <= yamcs-5.7.3 or >= yamcs-5.7.2, <= yamcs-5.7.2 or >= yamcs-5.7.1, <= yamcs-5.7.1 or >= yamcs-5.7.0, <= yamcs-5.7.0 or >= yamcs-5.6.2, <= yamcs-5.6.2 or >= yamcs-5.5.7, <= yamcs-5.5.7 or >= yamcs-5.6.1, <= yamcs-5.6.1 or >= yamcs-5.6.0, <= yamcs-5.6.0 or >= yamcs-5.5.6, <= yamcs-5.5.6 or >= before-removing-cfdp-half-implemented-features, <= before-removing-cfdp-half-implemented-features or >= yamcs-5.5.5, <= yamcs-5.5.5 or >= yamcs-5.5.4, <= yamcs-5.5.4 or >= yamcs-5.5.3, <= yamcs-5.5.3 or >= yamcs-5.5.2, <= yamcs-5.5.2 or >= yamcs-5.5.1, <= yamcs-5.5.1 or >= yamcs-5.5.0, <= yamcs-5.5.0 or >= yamcs-5.3.5, <= yamcs-5.3.5 or >= yamcs-5.4.3, <= yamcs-5.4.3 or >= yamcs-5.4.2, <= yamcs-5.4.2 or >= yamcs-5.4.1, <= yamcs-5.4.1 or >= yamcs-5.4.0, <= yamcs-5.4.0 or >= yamcs-5.2.0, <= yamcs-5.2.0 or >= yamcs-5.3.4, <= yamcs-5.3.4 or >= yamcs-5.3.3, <= yamcs-5.3.3 or >= yamcs-5.3.2, <= yamcs-5.3.2 or >= yamcs-5.3.1, <= yamcs-5.3.1 or >= yamcs-5.3.0, <= yamcs-5.3.0 or >= yamcs-5.1.3, <= yamcs-5.1.3 or >= yamcs-5.1.2, <= yamcs-5.1.2 or >= yamcs-5.1.1, <= yamcs-5.1.1 or >= yamcs-5.1.0, <= yamcs-5.1.0 or >= yamcs-5.0.1, <= yamcs-5.0.1 or >= yamcs-5.0.0, <= yamcs-5.0.0 or >= yamcs-4.10.9, <= yamcs-4.10.9 or >= yamcs-4.10.8, <= yamcs-4.10.8 or >= yamcs-4.10.7, <= yamcs-4.10.7 or >= yamcs-4.10.6, <= yamcs-4.10.6 or >= yamcs-4.10.5, <= yamcs-4.10.5 or >= yamcs-4.10.4, <= yamcs-4.10.4 or >= yamcs-4.10.3, <= yamcs-4.10.3 or >= yamcs-4.10.2, <= yamcs-4.10.2 or >= yamcs-4.10.1, <= yamcs-4.10.1 or >= yamcs-4.10.0, <= yamcs-4.10.0 or >= yamcs-4.9.5, <= yamcs-4.9.5 or >= yamcs-4.9.4, <= yamcs-4.9.4 or >= yamcs-4.9.3, <= yamcs-4.9.3 or >= yamcs-4.9.2, <= yamcs-4.9.2 or >= yamcs-4.9.1, <= yamcs-4.9.1 or >= yamcs-4.9.0, <= yamcs-4.9.0 or >= yamcs-4.8.1, <= yamcs-4.8.1 or >= yamcs-4.8.0, <= yamcs-4.8.0 or >= yamcs-4.7.3, <= yamcs-4.7.3 or >= yamcs-4.7.2, <= yamcs-4.7.2 or >= yamcs-4.7.1, <= yamcs-4.7.1 or >= yamcs-4.7, <= yamcs-4.7 or >= yamcs-4.4.2, <= yamcs-4.4.2 or >= yamcs-4.4.1, <= yamcs-4.4.1 or >= yamcs-4.4.0, <= yamcs-4.4.0 or >= yamcs-4.3.1, <= yamcs-4.3.1 or >= yamcs-4.3.0, <= yamcs-4.3.0 or >= yamcs-4.2.2, <= yamcs-4.2.2 or >= yamcs-4.2.1, <= yamcs-4.2.1 or >= yamcs-4.2.0, <= yamcs-4.2.0 or >= yamcs-4.1.2, <= yamcs-4.1.2 or >= yamcs-4.1.1, <= yamcs-4.1.1 or >= yamcs-4.0.1, <= yamcs-4.0.1 or >= yamcs-3.4.0, <= yamcs-3.4.0 or >= yamcs-3.3.0, <= yamcs-3.3.0 or >= yamcs-3.2.2, <= yamcs-3.2.2 or >= yamcs-3.2.1, <= yamcs-3.2.1 or >= yamcs-3.2.0, <= yamcs-3.2.0 or >= yamcs-3.1.2, <= yamcs-3.1.2 or >= yamcs-3.1.1, <= yamcs-3.1.1 or >= yamcs-3.1.0, <= yamcs-3.1.0 or >= yamcs-3.0.0, <= yamcs-3.0.0 or >= yamcs-0.30.0, <= yamcs-0.30.0 or >= v0.29.4, <= v0.29.4 or >= v0.29.3-20160608, <= v0.29.3-20160608 or >= v0.29.3, <= v0.29.3 or >= v0.29.1, <= v0.29.1 or >= v0.29.1-20160127, <= v0.29.1-20160127 or >= v0.29.1-20160119, <= v0.29.1-20160119 or >= v0.29.1-20151214, <= v0.29.1-20151214 or >= v0.29.0, <= v0.29.0 or >= v0.28.0, <= v0.28.0 or >= v0.28.0-20150903, <= v0.28.0-20150903 or >= v0.28.0-20150902-2, <= v0.28.0-20150902-2 or >= v0.28.0-20150902, <= v0.28.0-20150902 or >= v0.28.0-20150901, <= v0.28.0-20150901 or >= v0.28.0-20150828, <= v0.28.0-20150828 or >= v0.28.0-20150827, <= v0.28.0-20150827 or >= v0.28.0-20150826, <= v0.28.0-20150826 or >= v0.28.0-20150825, <= v0.28.0-20150825 or >= v0.28.0-20150824, <= v0.28.0-20150824 or >= v0.28.0-20150820, <= v0.28.0-20150820 or >= v0.28.0-20150817, <= v0.28.0-20150817 or >= v0.28.0-20150811, <= v0.28.0-20150811 or >= v0.26.1, <= v0.26.1 or >= v0.26.0, <= v0.26.0
Patched version
Not yet available
CVE-2026-44632GHSA-3G44-3M7X-CGG2GHSA-524G-X36V-9WM6

Yamcs is under investigation for a critical vulnerability that allows authenticated remote code execution via StreamSQL injection. Users with the ControlArchiving privilege are at risk.

What happened

Yamcs, a mission control system, is reportedly vulnerable to authenticated remote code execution (RCE) due to an injection vulnerability in the StreamSQL aggregate-compiler. An authenticated user with the ControlArchiving system privilege can inject arbitrary Java code, leading to RCE on the Yamcs host.

The vulnerability affects multiple versions of yamcs-core, ranging from yamcs-5.12.6 down to v0.26.0. The specific versions impacted include yamcs-5.12.6, yamcs-5.12.5, yamcs-5.12.4, yamcs-5.12.3, yamcs-5.12.2, yamcs-5.12.1, yamcs-5.12.0, yamcs-5.11.7, yamcs-5.9.8, yamcs-5.11.6, yamcs-5.11.5, yamcs-5.11.4, yamcs-5.10.9, yamcs-5.11.3, yamcs-5.11.2, yamcs-5.11.1, yamcs-5.11.0, yamcs-5.10.8, yamcs-5.10.7, yamcs-5.10.6, yamcs-5.10.5, yamcs-5.10.4, yamcs-5.10.3, yamcs-5.10.2, yamcs-5.10.1, yamcs-5.10.0, yamcs-5.9.7, yamcs-5.9.6, yamcs-5.9.5, yamcs-5.9.4, yamcs-5.9.3, yamcs-5.9.2, yamcs-5.9.1, yamcs-5.9.0, yamcs-5.8.8, yamcs-5.8.7, yamcs-5.8.6, yamcs-5.8.5, yamcs-5.8.4, yamcs-5.8.3, yamcs-5.8.2, yamcs-5.8.0, yamcs-5.8.1, yamcs-5.7.10, yamcs-5.7.9, yamcs-5.7.8, yamcs-5.7.7, yamcs-5.7.6, yamcs-5.7.5, yamcs-5.7.4, yamcs-5.7.3, yamcs-5.7.2, yamcs-5.7.1, yamcs-5.7.0, yamcs-5.6.2, yamcs-5.5.7, yamcs-5.6.1, yamcs-5.6.0, yamcs-5.5.6, yamcs-5.5.5, yamcs-5.5.4, yamcs-5.5.3, yamcs-5.5.2, yamcs-5.5.1, yamcs-5.5.0, yamcs-5.3.5, yamcs-5.4.3, yamcs-5.4.2, yamcs-5.4.1, yamcs-5.4.0, yamcs-5.2.0, yamcs-5.3.4, yamcs-5.3.3, yamcs-5.3.2, yamcs-5.3.1, yamcs-5.3.0, yamcs-5.1.3, yamcs-5.1.2, yamcs-5.1.1, yamcs-5.1.0, yamcs-5.0.1, yamcs-5.0.0, yamcs-4.10.9, yamcs-4.10.8, yamcs-4.10.7, yamcs-4.10.6, yamcs-4.10.5, yamcs-4.10.4, yamcs-4.10.3, yamcs-4.10.2, yamcs-4.10.1, yamcs-4.10.0, yamcs-4.9.5, yamcs-4.9.4, yamcs-4.9.3, yamcs-4.9.2, yamcs-4.9.1, yamcs-4.9.0, yamcs-4.8.1, yamcs-4.8.0, yamcs-4.7.3, yamcs-4.7.2, yamcs-4.7.1, yamcs-4.7, yamcs-4.4.2, yamcs-4.4.1, yamcs-4.4.0, yamcs-4.3.1, yamcs-4.3.0, yamcs-4.2.2, yamcs-4.2.1, yamcs-4.2.0, yamcs-4.1.2, yamcs-4.1.1, yamcs-4.0.1, yamcs-3.4.0, yamcs-3.3.0, yamcs-3.2.2, yamcs-3.2.1, yamcs-3.2.0, yamcs-3.1.2, yamcs-3.1.1, yamcs-3.1.0, yamcs-3.0.0, yamcs-0.30.0, v0.29.4, v0.29.3-20160608, v0.29.3, v0.29.1, v0.29.1-20160127, v0.29.1-20160119, v0.29.1-20151214, v0.29.0, v0.28.0, v0.28.0-20150903, v0.28.0-20150902-2, v0.28.0-20150902, v0.28.0-20150901, v0.28.0-20150828, v0.28.0-20150827, v0.28.0-20150826, v0.28.0-20150825, v0.28.0-20150824, v0.28.0-20150820, v0.28.0-20150817, v0.28.0-20150811, v0.26.1, v0.26.0.

What to do about it

How 0Day would have caught this

MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If yamcs-core is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Frequently asked questions

Am I affected?

You are affected if you are using any version of yamcs-core from yamcs-5.12.6 down to v0.26.0.

What should I do right now?

Upgrade to a version of Yamcs-core that addresses this vulnerability or apply the provided fix if available. Monitor the primary sources for updates.

Is there an official fix available?

No official fix has been published yet. Monitor the sources for updates.

Sources

Join the 0Day waitlist →

← Back to all threats