Skip to main content

Eclipse Milo EUVDEUVD-2026-52663

| CVE-2026-58080 HIGH
Missing Authorization (CWE-862)
2026-08-04 eclipse GHSA-pvvm-cxq7-hrgr
Authentication Bypass Eclipse Milo
8.8
CVSS 4.0 · Vendor: eclipse
Share

Severity by source

Vendor (eclipse) PRIMARY
8.8 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.2 HIGH

Network vector, no credentials needed when anonymous sessions are permitted; high integrity impact from unguarded method invocation and node deletion; limited confidentiality exposure (metadata only); no availability impact described.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (eclipse).

CVSS VectorVendor: eclipse

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

4
Patch available
Aug 04, 2026 - 13:16 EUVD
Source Code Evidence Fetched
Aug 04, 2026 - 13:08 vuln.today
Analysis Generated
Aug 04, 2026 - 13:08 vuln.today
CVE Published
Aug 04, 2026 - 12:05 cve.org
HIGH 8.8

DescriptionCVE.org

In Eclipse Milo versions 1.0.0 through 1.1.4, OpcUaServerConfig.copy() fails to preserve a configured RoleMapper. On servers that rely on role permissions and construct the running configuration through copy(), sessions receive no role IDs and the default access controller skips role-permission checks, allowing an anonymous client where anonymous sessions are permitted to read role-permission metadata, invoke protected methods, or delete protected nodes.

AnalysisAI

Silent authorization bypass in Eclipse Milo OPC UA server SDK versions 1.0.0-1.1.4 allows anonymous network clients to invoke protected methods, read role-permission metadata, and delete protected nodes. The defect is a missing field copy in OpcUaServerConfig.copy(): when servers construct their running configuration via this method, the configured RoleMapper is silently dropped, causing the DefaultAccessController to receive empty role ID lists for every session and skip all role-permission enforcement. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Identify OPC UA server on network
Delivery
Connect anonymously (anonymous sessions enabled)
Exploit
Server config missing RoleMapper due to copy() omission
Execution
DefaultAccessController skips role-permission checks
Impact
Invoke protected methods or delete protected nodes
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires two simultaneous server-side conditions: (1) anonymous sessions must be enabled - the server's `IdentityValidator` must accept anonymous identity tokens, which is a deliberate configuration choice and not the default for security-hardened deployments; and (2) the server's active `OpcUaServerConfig` must have been derived using `OpcUaServerConfig.copy()`, causing the `RoleMapper` to be silently omitted from the copied configuration. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H) reflects a network-accessible, low-complexity flaw with no authentication requirement and high integrity impact - an accurate characterization for environments where both conditions are met. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker with network access to the OPC UA server port (default 4840/TCP) connects using any standard OPC UA client library with an anonymous session. Because the server's configuration was constructed via `OpcUaServerConfig.copy()` and the `RoleMapper` was silently dropped, the `DefaultAccessController` assigns no roles to the session and skips permission enforcement. …
Remediation Apply the upstream fix by upgrading to a version of Eclipse Milo that incorporates commit d51f03e9a75f313ab41c3d68d809f4b922073f1a (https://github.com/eclipse-milo/milo/commit/d51f03e9a75f313ab41c3d68d809f4b922073f1a); monitor the Eclipse Milo GitHub releases page and the Eclipse security advisory at https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/598 for a formal patched release version, which has not been confirmed in available references. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory all systems running Eclipse Milo SDK versions 1.0.0 through 1.1.4 and document their network exposure, particularly any instances accessible from untrusted networks. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Eclipse Milo

View all
CVE-2026-60007 CRITICAL
9.1 Aug 04

Password recovery in Eclipse Milo (the open-source OPC UA SDK for Java) versions 0.6.0 through 1.1.4 allows an on-path a
CVE-2026-63252 HIGH
8.7 Aug 04

Unauthenticated remote denial-of-service in Eclipse Milo 0.6.0-1.1.4 allows any network-accessible client to exhaust the
CVE-2026-62927 HIGH
8.7 Aug 04

Authorization bypass in Eclipse Milo's OPC UA Call service (versions 1.0.0-1.1.4) permits unauthenticated or low-privile
CVE-2026-61387 MEDIUM
6.9 Aug 04

Unauthenticated remote clients can permanently exhaust the global monitored-item quota in Eclipse Milo OPC UA SDK versio
CVE-2026-63248 MEDIUM
6.9 Aug 04

Session security diagnostics nodes in Eclipse Milo 0.6.0 through 1.1.4 expose sensitive OPC UA session metadata without

Same weakness CWE-862 – Missing Authorization

View all
CVE-2023-52163 HIGH POC
8.8
CVE-2025-6205 CRITICAL POC
9.1
CVE-2025-20362 HIGH POC
8.6
CVE-2017-9232 CRITICAL POC
9.8
CVE-2023-6875 CRITICAL POC
9.8
CVE-2024-4898 CRITICAL POC
9.8
CVE-2023-32117 CRITICAL POC
9.8
CVE-2020-36719 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

EUVD-2026-52663 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy