CVE-2026-46621: Yamcs remote code execution in Python algorithm engine

CVE-2026-46621 · Severity: critical · CVSS 9.1 · Published 2026-07-16

Yamcs is a mission control framework used to manage space missions and complex telemetry data. A security vulnerability in its script evaluation engine allows an authorized user to inject malicious code into the system. If exploited, an attacker could take complete control of the server hosting the framework, potentially leading to data theft or disruption of mission operations.

Technologies: org.yamcs:yamcs-core (Maven), Yamcs. Vendors: Maven, Yamcs.

Quick answers

Is CVE-2026-46621 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-46621 being exploited in the wild.
How severe is CVE-2026-46621?
Critical severity, with a CVSS score of 9.1, published 16 July 2026.
Which products and versions are affected?
org.yamcs:yamcs-core (Maven) < 5.12.7, ECOSYSTEM:introduced=0,fixed=5.12.7; Yamcs < 5.12.7, < 5.12.7, < 5.13.0.
Is there a fix for CVE-2026-46621?
Yes. org.yamcs:yamcs-core (Maven): upgrade to 5.12.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46621 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-46621?
Check whether you run org.yamcs:yamcs-core (Maven) or Yamcs at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.yamcs:yamcs-core (Maven): upgrade to 5.12.7 or later
    # set org.yamcs:yamcs-core to 5.12.7 in your pom.xml or build.gradle

Technical details

A code injection vulnerability exists in the Yamcs script evaluation engine for Python algorithms. Prior to versions 5.12.7 and 5.13.0, the engine used Jython via the JSR-223 ScriptEngine API to compile and evaluate user-controlled algorithm text without a secure sandbox. An authenticated attacker with 'ChangeMissionDatabase' privileges can use the mission database REST API to override algorithm logic. By importing and executing arbitrary Java classes (e.g., java.lang.Runtime), the attacker can achieve remote code execution (RCE) on the underlying host. The fix involves disabling algorithm editing by default.

Affected products

  • Yamcs Yamcs < 5.12.7, < 5.13.0

Identifiers

  • CVE-2026-46621
  • GHSA-2g95-6x5q-xjwj

Timeline

  • 2026-05-21: patched: Fixes released in versions 5.12.7 and 5.13.0
  • 2026-07-16: disclosed: CVE-2026-46621 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.