Yamcs Vulnerable to Authenticated Remote Code Execution
- Severity
- HIGH
- Affected component
- yamcs (maven)
- Affected versions
- >= yamcs-5.12.6, <= yamcs-5.12.6 or >= yamcs-5.12.5, <= yamcs-5.12.5 or >= yamcs-5.12.4, <= yamcs-5.12.4 or >= yamcs-5.12.3, <= yamcs-5.12.3 or >= yamcs-5.12.2, <= yamcs-5.12.2 or >= yamcs-5.12.1, <= yamcs-5.12.1 or >= yamcs-5.12.0, <= yamcs-5.12.0 or >= yamcs-5.11.7, <= yamcs-5.11.7 or >= yamcs-5.9.8, <= yamcs-5.9.8 or >= yamcs-5.11.6, <= yamcs-5.11.6 or >= yamcs-5.11.5, <= yamcs-5.11.5 or >= yamcs-5.11.4, <= yamcs-5.11.4 or >= yamcs-5.10.9, <= yamcs-5.10.9 or >= yamcs-5.11.3, <= yamcs-5.11.3 or >= yamcs-5.11.2, <= yamcs-5.11.2 or >= yamcs-5.11.1, <= yamcs-5.11.1 or >= yamcs-5.11.0, <= yamcs-5.11.0 or >= yamcs-5.10.8, <= yamcs-5.10.8 or >= yamcs-5.10.7, <= yamcs-5.10.7 or >= yamcs-5.10.6, <= yamcs-5.10.6 or >= yamcs-5.10.5, <= yamcs-5.10.5 or >= yamcs-5.10.4, <= yamcs-5.10.4 or >= yamcs-5.10.3, <= yamcs-5.10.3 or >= yamcs-5.10.2, <= yamcs-5.10.2 or >= yamcs-5.10.1, <= yamcs-5.10.1 or >= yamcs-5.10.0, <= yamcs-5.10.0 or >= yamcs-5.9.7, <= yamcs-5.9.7 or >= yamcs-5.9.6, <= yamcs-5.9.6 or >= yamcs-5.9.5, <= yamcs-5.9.5 or >= yamcs-5.9.4, <= yamcs-5.9.4 or >= yamcs-5.9.3, <= yamcs-5.9.3 or >= yamcs-5.9.2, <= yamcs-5.9.2 or >= yamcs-5.9.1, <= yamcs-5.9.1 or >= yamcs-5.9.0, <= yamcs-5.9.0 or >= yamcs-5.8.8, <= yamcs-5.8.8 or >= yamcs-5.8.7, <= yamcs-5.8.7 or >= yamcs-5.8.6, <= yamcs-5.8.6 or >= yamcs-5.8.5, <= yamcs-5.8.5 or >= yamcs-5.8.4, <= yamcs-5.8.4 or >= yamcs-5.8.3, <= yamcs-5.8.3 or >= yamcs-5.8.2, <= yamcs-5.8.2 or >= yamcs-5.8.0, <= yamcs-5.8.0 or >= yamcs-5.8.1, <= yamcs-5.8.1 or >= yamcs-5.7.10, <= yamcs-5.7.10 or >= yamcs-5.7.9, <= yamcs-5.7.9 or >= yamcs-5.7.8, <= yamcs-5.7.8 or >= yamcs-5.7.7, <= yamcs-5.7.7 or >= yamcs-5.7.6, <= yamcs-5.7.6 or >= yamcs-5.7.5, <= yamcs-5.7.5 or >= yamcs-5.7.4, <= yamcs-5.7.4 or >= yamcs-5.7.3, <= yamcs-5.7.3 or >= yamcs-5.7.2, <= yamcs-5.7.2 or >= yamcs-5.7.1, <= yamcs-5.7.1 or >= yamcs-5.7.0, <= yamcs-5.7.0 or >= yamcs-5.6.2, <= yamcs-5.6.2 or >= yamcs-5.5.7, <= yamcs-5.5.7 or >= yamcs-5.6.1, <= yamcs-5.6.1 or >= yamcs-5.6.0, <= yamcs-5.6.0 or >= yamcs-5.5.6, <= yamcs-5.5.6 or >= before-removing-cfdp-half-implemented-features, <= before-removing-cfdp-half-implemented-features or >= yamcs-5.5.5, <= yamcs-5.5.5 or >= yamcs-5.5.4, <= yamcs-5.5.4 or >= yamcs-5.5.3, <= yamcs-5.5.3 or >= yamcs-5.5.2, <= yamcs-5.5.2 or >= yamcs-5.5.1, <= yamcs-5.5.1 or >= yamcs-5.5.0, <= yamcs-5.5.0 or >= yamcs-5.3.5, <= yamcs-5.3.5 or >= yamcs-5.4.3, <= yamcs-5.4.3 or >= yamcs-5.4.2, <= yamcs-5.4.2 or >= yamcs-5.4.1, <= yamcs-5.4.1 or >= yamcs-5.4.0, <= yamcs-5.4.0 or >= yamcs-5.2.0, <= yamcs-5.2.0 or >= yamcs-5.3.4, <= yamcs-5.3.4 or >= yamcs-5.3.3, <= yamcs-5.3.3 or >= yamcs-5.3.2, <= yamcs-5.3.2 or >= yamcs-5.3.1, <= yamcs-5.3.1 or >= yamcs-5.3.0, <= yamcs-5.3.0 or >= yamcs-5.1.3, <= yamcs-5.1.3 or >= yamcs-5.1.2, <= yamcs-5.1.2 or >= yamcs-5.1.1, <= yamcs-5.1.1 or >= yamcs-5.1.0, <= yamcs-5.1.0 or >= yamcs-5.0.1, <= yamcs-5.0.1 or >= yamcs-5.0.0, <= yamcs-5.0.0 or >= yamcs-4.10.9, <= yamcs-4.10.9 or >= yamcs-4.10.8, <= yamcs-4.10.8 or >= yamcs-4.10.7, <= yamcs-4.10.7 or >= yamcs-4.10.6, <= yamcs-4.10.6 or >= yamcs-4.10.5, <= yamcs-4.10.5 or >= yamcs-4.10.4, <= yamcs-4.10.4 or >= yamcs-4.10.3, <= yamcs-4.10.3 or >= yamcs-4.10.2, <= yamcs-4.10.2 or >= yamcs-4.10.1, <= yamcs-4.10.1 or >= yamcs-4.10.0, <= yamcs-4.10.0 or >= yamcs-4.9.5, <= yamcs-4.9.5 or >= yamcs-4.9.4, <= yamcs-4.9.4 or >= yamcs-4.9.3, <= yamcs-4.9.3 or >= yamcs-4.9.2, <= yamcs-4.9.2 or >= yamcs-4.9.1, <= yamcs-4.9.1 or >= yamcs-4.9.0, <= yamcs-4.9.0 or >= yamcs-4.8.1, <= yamcs-4.8.1 or >= yamcs-4.8.0, <= yamcs-4.8.0 or >= yamcs-4.7.3, <= yamcs-4.7.3 or >= yamcs-4.7.2, <= yamcs-4.7.2 or >= yamcs-4.7.1, <= yamcs-4.7.1 or >= yamcs-4.7, <= yamcs-4.7 or >= yamcs-4.4.2, <= yamcs-4.4.2 or >= yamcs-4.4.1, <= yamcs-4.4.1 or >= yamcs-4.4.0, <= yamcs-4.4.0 or >= yamcs-4.3.1, <= yamcs-4.3.1 or >= yamcs-4.3.0, <= yamcs-4.3.0 or >= yamcs-4.2.2, <= yamcs-4.2.2 or >= yamcs-4.2.1, <= yamcs-4.2.1 or >= yamcs-4.2.0, <= yamcs-4.2.0 or >= yamcs-4.1.2, <= yamcs-4.1.2 or >= yamcs-4.1.1, <= yamcs-4.1.1 or >= yamcs-4.0.1, <= yamcs-4.0.1 or >= yamcs-3.4.0, <= yamcs-3.4.0 or >= yamcs-3.3.0, <= yamcs-3.3.0 or >= yamcs-3.2.2, <= yamcs-3.2.2 or >= yamcs-3.2.1, <= yamcs-3.2.1 or >= yamcs-3.2.0, <= yamcs-3.2.0 or >= yamcs-3.1.2, <= yamcs-3.1.2 or >= yamcs-3.1.1, <= yamcs-3.1.1 or >= yamcs-3.1.0, <= yamcs-3.1.0 or >= yamcs-3.0.0, <= yamcs-3.0.0 or >= yamcs-0.30.0, <= yamcs-0.30.0 or >= v0.29.4, <= v0.29.4 or >= v0.29.3-20160608, <= v0.29.3-20160608 or >= v0.29.3, <= v0.29.3 or >= v0.29.1, <= v0.29.1 or >= v0.29.1-20160127, <= v0.29.1-20160127 or >= v0.29.1-20160119, <= v0.29.1-20160119 or >= v0.29.1-20151214, <= v0.29.1-20151214 or >= v0.29.0, <= v0.29.0 or >= v0.28.0, <= v0.28.0 or >= v0.28.0-20150903, <= v0.28.0-20150903 or >= v0.28.0-20150902-2, <= v0.28.0-20150902-2 or >= v0.28.0-20150902, <= v0.28.0-20150902 or >= v0.28.0-20150901, <= v0.28.0-20150901 or >= v0.28.0-20150828, <= v0.28.0-20150828 or >= v0.28.0-20150827, <= v0.28.0-20150827 or >= v0.28.0-20150826, <= v0.28.0-20150826 or >= v0.28.0-20150825, <= v0.28.0-20150825 or >= v0.28.0-20150824, <= v0.28.0-20150824 or >= v0.28.0-20150820, <= v0.28.0-20150820 or >= v0.28.0-20150817, <= v0.28.0-20150817 or >= v0.28.0-20150811, <= v0.28.0-20150811 or >= v0.26.1, <= v0.26.1 or >= v0.26.0, <= v0.26.0
- Patched version
- Not yet available
Yamcs, a software package, is under investigation for multiple authenticated remote code execution vulnerabilities. Users of Yamcs versions from yamcs-0.26.0 to yamcs-5.13.0 are potentially affected.
What happened
Yamcs is reportedly vulnerable to authenticated remote code execution via injection flaws in its StreamSQL aggregate expression compiler and instance-template argument YAML injection. An authenticated user with specific privileges can inject and execute arbitrary Java code on the Yamcs server. The vulnerabilities have been tracked under CVE-2026-44632, GHSA-3G44-3M7X-CGG2, and GHSA-524G-X36V-9WM6.
The affected versions span from yamcs-0.26.0 to yamcs-5.13.0, inclusive. The specific versions impacted include, but are not limited to, yamcs-5.12.6, yamcs-5.12.5, yamcs-5.12.4, yamcs-5.12.3, yamcs-5.12.2, yamcs-5.12.1, yamcs-5.12.0, yamcs-5.11.7, yamcs-5.9.8, yamcs-5.11.6, yamcs-5.11.5, yamcs-5.11.4, yamcs-5.10.9, yamcs-5.11.3, yamcs-5.11.2, yamcs-5.11.1, yamcs-5.11.0, yamcs-5.10.8, yamcs-5.10.7, yamcs-5.10.6, yamcs-5.10.5, yamcs-5.10.4, yamcs-5.10.3, yamcs-5.10.2, yamcs-5.10.1, yamcs-5.10.0, yamcs-5.9.7, yamcs-5.9.6, yamcs-5.9.5, yamcs-5.9.4, yamcs-5.9.3, yamcs-5.9.2, yamcs-5.9.1, yamcs-5.9.0, yamcs-5.8.8, yamcs-5.8.7, yamcs-5.8.6, yamcs-5.8.5, yamcs-5.8.4, yamcs-5.8.3, yamcs-5.8.2, yamcs-5.8.0, yamcs-5.8.1, yamcs-5.7.10, yamcs-5.7.9, yamcs-5.7.8, yamcs-5.7.7, yamcs-5.7.6, yamcs-5.7.5, yamcs-5.7.4, yamcs-5.7.3, yamcs-5.7.2, yamcs-5.7.1, yamcs-5.7.0, yamcs-5.6.2, yamcs-5.5.7, yamcs-5.6.1, yamcs-5.6.0, yamcs-5.5.6, yamcs-5.5.5, yamcs-5.5.4, yamcs-5.5.3, yamcs-5.5.2, yamcs-5.5.1, yamcs-5.5.0, yamcs-5.3.5, yamcs-5.4.3, yamcs-5.4.2, yamcs-5.4.1, yamcs-5.4.0, yamcs-5.2.0, yamcs-5.3.4, yamcs-5.3.3, yamcs-5.3.2, yamcs-5.3.1, yamcs-5.3.0, yamcs-5.1.3, yamcs-5.1.2, yamcs-5.1.1, yamcs-5.1.0, yamcs-5.0.1, yamcs-5.0.0, yamcs-4.10.9, yamcs-4.10.8, yamcs-4.10.7, yamcs-4.10.6, yamcs-4.10.5, yamcs-4.10.4, yamcs-4.10.3, yamcs-4.10.2, yamcs-4.10.1, yamcs-4.10.0, yamcs-4.9.5, yamcs-4.9.4, yamcs-4.9.3, yamcs-4.9.2, yamcs-4.9.1, yamcs-4.9.0, yamcs-4.8.1, yamcs-4.8.0, yamcs-4.7.3, yamcs-4.7.2, yamcs-4.7.1, yamcs-4.7, yamcs-4.4.2, yamcs-4.4.1, yamcs-4.4.0, yamcs-4.3.1, yamcs-4.3.0, yamcs-4.2.2, yamcs-4.2.1, yamcs-4.2.0, yamcs-4.1.2, yamcs-4.1.1, yamcs-4.0.1, yamcs-3.4.0, yamcs-3.3.0, yamcs-3.2.2, yamcs-3.2.1, yamcs-3.2.0, yamcs-3.1.2, yamcs-3.1.1, yamcs-3.1.0, yamcs-3.0.0, yamcs-0.30.0, v0.29.4, v0.29.3-20160608, v0.29.3, v0.29.1, v0.29.1-20160127, v0.29.1-20160119, v0.29.1-20151214, v0.29.0, v0.28.0, v0.28.0-20150903, v0.28.0-20150902-2, v0.28.0-20150902, v0.28.0-20150901, v0.28.0-20150828, v0.28.0-20150827, v0.28.0-20150826, v0.28.0-20150825, v0.28.0-20150824, v0.28.0-20150820, v0.28.0-20150817, v0.28.0-20150811, v0.26.1, v0.26.0.
What to do about it
- Identify and list all instances of Yamcs in use within your organization.
- Check the version of Yamcs currently deployed. If it falls within the affected range (yamcs-0.26.0 to yamcs-5.13.0), proceed with caution.
- Monitor the primary sources for updates on patched versions. No official fix has been published yet.
- Consider restricting access to the Yamcs server to minimize potential attack vectors until a patch is available.
- Stay informed by regularly checking the GitHub Advisory Database and other primary sources for updates on this vulnerability.
How 0Day would have caught this
yamcs is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If you are using Yamcs versions from yamcs-0.26.0 to yamcs-5.13.0, you are potentially affected.
What should I do right now?
Identify all instances of Yamcs in use, check their versions, and monitor primary sources for updates on a fix.
Has this been exploited in the wild?
There is no confirmed report of this vulnerability being exploited in the wild at this time.
Sources
- [GHSA-3g44-3m7x-cgg2] Yamcs vulnerable to authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql`
- [GHSA-73mf-m39p-wpm9] Yamcs vulnerable to Remote Code Execution via instance-template argument YAML injection (createInstance)
- [GHSA-c64q-hj4j-375f] Yamcs vulnerable to authenticated remote code execution via unescaped StreamSQL `LIKE` pattern compiled by Janino (`LikeExpression`)
- [GHSA-3g44-3m7x-cgg2] Yamcs vulnerable to authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql`