Second Janino RCE Path Found in Yamcs: StreamSQL Column-Name Injection Bypasses CVE-2026-44632 Fix

A new GitHub Security Advisory (GHSA-3g44-3m7x-cgg2, CVE-2026-55511, CVSS 9.1) discloses an authenticated remote code execution vulnerability in org.yamcs:yamcs-core, the mission-control system commonly used for satellite and spacecraft telemetry operations.

What was reported

According to the advisory, Yamcs compiles StreamSQL expressions to Java on the fly using Janino's SimpleCompiler, with no restrictive class-loading policy or sandbox. When a StreamSQL aggregate like sum(...) is applied to a column, the column's name is interpolated unescaped into the generated Java source. Because Yamcs allows arbitrary characters in a double-quoted column identifier and never validates them at creation, an authenticated user holding only the ControlArchiving system privilege can craft a malicious column name and inject arbitrary Java that gets compiled and executed via POST /api/archive/{instance}:executeSql.

The advisory notes this is a separate, independent Janino-RCE entry point from CVE-2026-44632 (GHSA-524g-x36v-9wm6). That earlier fix (5.13.0 / 5.12.7) hardened only the mission-database algorithm-override path, gated by the ChangeMissionDatabase privilege. The StreamSQL expression compiler was not touched and reportedly remains exploitable on 5.13.0 through the different ControlArchiving privilege. The report includes an end-to-end proof-of-concept run against a real, security-enabled Yamcs 5.13.0 server, showing a non-superuser account with only ControlArchiving successfully executing injected Java on the host, while an unprivileged account is rejected with a 403.

Why it matters for defenders

This affects any deployment of org.yamcs:yamcs-core, including the 5.13.0 release that already shipped a fix for the related CVE. Because ControlArchiving is described as an archive/table/stream management privilege rather than a superuser-level grant, the practical attack surface includes non-admin operators who are commonly granted archiving duties. Successful exploitation reportedly yields code execution in the Yamcs server JVM itself — with reach into filesystem access, process execution, reflection, and class loading — which could expose mission data, credentials available to the process, telemetry/archive integrity, and availability of the deployment.

What defenders should watch for or do now

• Review which accounts hold SystemPrivilege.ControlArchiving and tighten that grant to only those who genuinely need archive/table/stream management.
• Monitor and alert on POST /api/archive/{instance}:executeSql calls, especially CREATE TABLE/CREATE STREAM statements defining columns with unusual characters (semicolons, braces, parentheses) in the identifier — a strong indicator of injection attempts.
• Watch for anomalous file, process, or reflection activity originating from the Yamcs server process, since injected code runs with the Yamcs process's own privileges.
• Track upstream for a patched release, since the advisory states the CVE-2026-44632 fix did not address this StreamSQL compiler path; until a fix lands, restricting or auditing ControlArchiving grants is the primary mitigation described.
• Treat this as a reminder to check for other unsandboxed Janino/dynamic-compilation sinks in the same codebase, since the advisory frames this as a recurring pattern rather than an isolated bug.

Developing intel

This is net-new, same-day intelligence based on a single GitHub Security Advisory; no CISA KEV listing, vendor patch, or independent confirmation is referenced here. Details may evolve as the maintainers respond. Read the full technical writeup and proof-of-concept at the original GHSA advisory.