9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-46562

CVE-2026-46562: Yamcs Vulnerable to Remote Code Execution via Mission Database algorithm override

Remote Code Execution via Mission Database algorithm override

Summary

The Nashorn ScriptEngine used to evaluate user-supplied algorithm text in MdbOverrideApi.updateAlgorithm is constructed without a ClassFilter, allowing a user with the ChangeMissionDatabase privilege to execute arbitrary Java code on the Yamcs server. In Yamcs's default configuration (no security.yaml), the built-in guest user has superuser=true, so the vulnerability is reachable without authentication.

Details

Vulnerable file: yamcs-core/src/main/java/org/yamcs/algorithms/ScriptAlgorithmExecutorFactory.java

// L46-53  Nashorn engine obtained without a ClassFilter
ScriptEngineFactory factory = scriptEngineManager.getEngineFactories().stream()
        .filter(candidate -> !JDK_BUILTIN_NASHORN_ENGINE_NAME.equals(candidate.getEngineName())
                && candidate.getNames().contains(language))
        .findFirst().orElse(null);
if (factory != null) {
    scriptEngine = factory.getScriptEngine();          // ← ClassFilter not supplied
}

// L109  user-supplied algorithm text reaches eval()
scriptEngine.eval(functionScript);

NashornScriptEngineFactory.getScriptEngine() accepts an optional ClassFilter that restricts which classes JavaScript can reach via Java.type(...). Yamcs passes no filter, so attacker-supplied JavaScript can reach any Java class — for example, Java.type("java.lang.Runtime").getRuntime().exec(...) runs arbitrary OS commands inside the Yamcs JVM.

The path from HTTP request to eval is: MdbOverrideApi.updateAlgorithm (yamcs-core/src/main/java/org/yamcs/http/api/MdbOverrideApi.java:145-189) → AlgorithmManager.overrideAlgorithm (yamcs-core/src/main/java/org/yamcs/algorithms/AlgorithmManager.java:529-559) → ScriptAlgorithmExecutorFactory.makeExecutor () → .

Miggo Vulnerability Database

→

CVE-2026-46562

CVE-2026-46562:

9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.yamcs:yamcs-core	maven	< 5.12.7	5.12.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Remote Code Execution (RCE) in Yamcs, identified as GHSA-vmwp-vh32-rj75. The root cause is the use of the Nashorn ScriptEngine to evaluate user-provided algorithm text without proper sandboxing. Specifically, the ScriptEngine is instantiated without a ClassFilter, which allows a malicious script to access any Java class and execute arbitrary code on the server.

The exploitation path begins when a user with the ChangeMissionDatabase privilege (or an unauthenticated user in the default configuration) sends a PATCH request to the /api/mdb-overrides/{instance}/{processor}/algorithms/{algorithm} endpoint. This request is handled by the org.yamcs.http.api.MdbOverrideApi.updateAlgorithm function.

This function then calls org.yamcs.algorithms.AlgorithmManager.overrideAlgorithm, which in turn uses org.yamcs.algorithms.ScriptAlgorithmExecutorFactory.makeExecutor to create an executor for the new algorithm script. It is within makeExecutor that the unsandboxed ScriptEngine is created and the user-provided script is executed via eval(), resulting in RCE.

The patch for this vulnerability does not fix the underlying issue of the missing ClassFilter. Instead, it introduces a configuration option, overrideAlgorithmsEnabled, which is set to false by default, effectively disabling the vulnerable feature and preventing the execution of user-provided algorithm scripts.

Vulnerable functions

org.yamcs.http.api.MdbOverrideApi.updateAlgorithm

yamcs-core/src/main/java/org/yamcs/http/api/MdbOverrideApi.java

This function is the entry point for the vulnerability. It handles the HTTP request to update an algorithm. The patch adds a check to this function to disable the feature by default as a mitigation. An attacker would call this function to start the exploitation process.

org.yamcs.algorithms.AlgorithmManager.overrideAlgorithm

yamcs-core/src/main/java/org/yamcs/algorithms/AlgorithmManager.java

This function is called by `MdbOverrideApi.updateAlgorithm` and is responsible for managing the algorithm override. It orchestrates the process of replacing the existing algorithm with the user-provided one, eventually leading to the execution of the malicious script.

org.yamcs.algorithms.ScriptAlgorithmExecutorFactory.makeExecutor

yamcs-core/src/main/java/org/yamcs/algorithms/ScriptAlgorithmExecutorFactory.java

This function contains the core of the vulnerability. It creates a Nashorn `ScriptEngine` without a `ClassFilter`, which allows the script to access and execute arbitrary Java code. It then uses this engine to evaluate the user-provided algorithm text, leading to Remote Code Execution.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.