ETK-2026-488Zero's internal tracking ID, independent of the CVE number.
waiting for further signalsZero needs more public information before it can validate it.description
yamcs-core versions before 5.13.6 can allow YAML structure injection when reconfiguring a templated instance. An authenticated user with the CreateInstances privilege may persist unintended configuration changes and cause an instance restart failure; deployments with suitable templates and installed services may also permit code execution as the Yamcs service account. Exploitation requires a caller-controlled template argument in a YAML-sensitive template location.
mitigation
Upgrade org.yamcs:yamcs-core to version 5.13.6. Until the upgrade is complete, restrict the CreateInstances privilege and review instance templates to avoid interpolating caller-controlled values into YAML-sensitive locations.
fixed in 5.13.6
outcome
Contextual: an exploit technique exists, but no deterministic check could cover this one.
source signals
Public signals that triggered or updated the pipeline. These are inputs for the deltas above.
- 2026-10-01 11:30Zghsa: trigger signal, started the run
- 2026-10-01 11:30Z
this entry in the feed
GET /api/v1/feed/ETK-2026-488
{ "etk_id": "ETK-2026-488", "cve_id": null, "display_id": "ETK-2026-488", "ghsa_id": "GHSA-wqq5-5w4p-m569", "euvd_id": null, "status": "published", "anchor_state": "awaiting_cve", "title": "Yamcs Core instance reconfiguration YAML structure injection", "summary": "yamcs-core versions before 5.13.6 can allow YAML structure injection when reconfiguring a templated instance. An authenticated user with the CreateInstances privilege may persist unintended configuration changes and cause an instance restart failure; deployments with suitable templates and installed services may also permit code execution as the Yamcs service account. Exploitation requires a caller-controlled template argument in a YAML-sensitive template location.", "mitigation": "Upgrade org.yamcs:yamcs-core to version 5.13.6. Until the upgrade is complete, restrict the CreateInstances privilege and review instance templates to avoid interpolating caller-controlled values into YAML-sensitive locations.", "vendor": "maven", "product": "maven:org.yamcs:yamcs-core", "affected": [ { "affected_notes": [], "affected_ranges": [ "< 5.13.6" ], "ecosystem": "maven", "fixed_versions": [ "5.13.6" ], "package_name": "org.yamcs:yamcs-core", "purl": "pkg:maven/org.yamcs/yamcs-core" } ], "cwes": [ 74 ], "cvss_score": 7.2, "cvss_src": "cna_vendor", "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "epss_score": null, "epss_percentile": null, "epss_asof": null, "automation": "contextual", "check": false, "check_confidence_basis": null, "exploit": false, "pipeline_minutes": 29.84144455, "t0_at": null, "signals": { "public_poc": { "at": "2026-10-01T11:30:49+00:00", "days": -20.04620275318287, "is_lower_bound": true, "measured_at": "2026-10-21T12:37:20.955432+00:00", "url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-wqq5-5w4p-m569" }, "trigger_signal": { "at": "2026-10-01T11:30:49+00:00", "days": -20.04620275318287, "is_lower_bound": true, "measured_at": "2026-10-21T12:37:20.955432+00:00", "url": "https://github.com/yamcs/yamcs/security/advisories/GHSA-wqq5-5w4p-m569" } } }
published 2026-10-03 19:00Z
last change 2026-10-21 12:26Z
Need the technical details behind an entry?
Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.