Skip to main content

Eclipse Milo CVE-2026-63248

| EUVDEUVD-2026-52664 MEDIUM
Missing Authorization (CWE-862)
2026-08-04 eclipse GHSA-xg6h-qgc7-qqr7
Authentication Bypass Eclipse Milo
6.9
CVSS 4.0 · Vendor: eclipse
Share

Severity by source

Vendor (eclipse) PRIMARY
6.9 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.5 MEDIUM

Network-reachable anonymous path requires no privileges (PR:N, AC:L); partial session credential disclosure (C:L) and unauthorized diagnostics enable (I:L); no availability impact confirmed.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (eclipse).

CVSS VectorVendor: eclipse

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Source Code Evidence Fetched
Aug 04, 2026 - 13:06 vuln.today
Analysis Generated
Aug 04, 2026 - 13:06 vuln.today

DescriptionCVE.org

In Eclipse Milo versions 0.6.0 through 1.1.4, OPC UA server diagnostics nodes do not enforce access authorization. An anonymous client can enable diagnostics over a None/None endpoint without a certificate; with a trusted client application certificate over SignAndEncrypt, it can read security diagnostics for other active sessions, exposing usernames, login history, authentication mechanisms, security modes and policies, and public client certificates.

AnalysisAI

Session security diagnostics nodes in Eclipse Milo 0.6.0 through 1.1.4 expose sensitive OPC UA session metadata without enforcing any authorization checks, a CWE-862 (Missing Authorization) flaw. An unauthenticated anonymous client connecting over a None/None (no-security) endpoint can enable the diagnostics subsystem with no certificate or credentials whatsoever; separately, a client presenting a trusted application certificate over SignAndEncrypt can read the SessionSecurityDiagnosticsArray for all active server sessions, harvesting usernames, login history, authentication mechanisms, session security modes and policies, and public client certificates. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Connect to None/None OPC UA endpoint anonymously
Delivery
Invoke unprotected diagnostics node without authorization check
Exploit
Enable diagnostics subsystem server-wide
Execution
Reconnect using trusted application certificate over SignAndEncrypt
Persist
Read SessionSecurityDiagnosticsArray for all active sessions
Impact
Exfiltrate usernames, auth mechanisms, security policies, and client certificates
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Two distinct and separate exploitation conditions exist. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N) scores 6.9 (Medium), accurately reflecting the network-accessible, zero-prerequisite anonymous path alongside limited-scope impacts: partial confidentiality loss from session credential disclosure (VC:L) and low-integrity impact from unauthorized diagnostics activation (VI:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker on the same network segment as an Eclipse Milo OPC UA server connects anonymously to a None/None endpoint using any standard OPC UA client tool (such as the open-source UaExpert or python-opcua library), invokes the unprotected diagnostics node to enable the subsystem, then uses a previously obtained or registered trusted application certificate to reconnect via SignAndEncrypt and read the SessionSecurityDiagnosticsArray - harvesting active-session usernames, authentication tokens, and client certificates for all connected clients. No proof-of-concept exploit has been identified, but the attack requires only standard OPC UA client tooling and knowledge of the diagnostics node address.
Remediation Upstream fix is available as commit a5dae1be0657d2b4fcb66e63f377c1dc36069e2a in the Eclipse Milo GitHub repository (https://github.com/eclipse-milo/milo/commit/a5dae1be0657d2b4fcb66e63f377c1dc36069e2a); a tagged release version incorporating this patch has not been independently confirmed from the available references - operators must verify with the Eclipse Milo project (https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/598) whether a patched release is available and upgrade to it. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Eclipse Milo

View all
CVE-2026-60007 CRITICAL
9.1 Aug 04

Password recovery in Eclipse Milo (the open-source OPC UA SDK for Java) versions 0.6.0 through 1.1.4 allows an on-path a
CVE-2026-58080 HIGH
8.8 Aug 04

Silent authorization bypass in Eclipse Milo OPC UA server SDK versions 1.0.0-1.1.4 allows anonymous network clients to i
CVE-2026-63252 HIGH
8.7 Aug 04

Unauthenticated remote denial-of-service in Eclipse Milo 0.6.0-1.1.4 allows any network-accessible client to exhaust the
CVE-2026-62927 HIGH
8.7 Aug 04

Authorization bypass in Eclipse Milo's OPC UA Call service (versions 1.0.0-1.1.4) permits unauthenticated or low-privile
CVE-2026-61387 MEDIUM
6.9 Aug 04

Unauthenticated remote clients can permanently exhaust the global monitored-item quota in Eclipse Milo OPC UA SDK versio

Same weakness CWE-862 – Missing Authorization

View all
CVE-2023-52163 HIGH POC
8.8
CVE-2025-6205 CRITICAL POC
9.1
CVE-2025-20362 HIGH POC
8.6
CVE-2017-9232 CRITICAL POC
9.8
CVE-2023-6875 CRITICAL POC
9.8
CVE-2024-4898 CRITICAL POC
9.8
CVE-2023-32117 CRITICAL POC
9.8
CVE-2020-36719 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2026-63248 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy