CVE-2026-63248: Medium severity Eclipse Milo Eclipse Milo vulnerability
In Eclipse Milo versions 0.6.0 through 1.1.4, OPC UA server diagnostics nodes do not enforce access authorization. An anonymous client can enable diagnostics over a None/None endpoint without a certificate; with a trusted client application certificate over SignAndEncrypt, it can read security diagnostics for other active sessions, exposing usernames, login history, authentication mechanisms, security modes and policies, and public client certificates.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Eclipse Milo OPC UA serverto a version that resolves this vulnerability.Fixed in 1.1.4
Event History
Frequently Asked Questions
What is the severity of CVE-2026-63248?
The severity of CVE-2026-63248 is rated as 57.
How do I fix CVE-2026-63248?
To fix CVE-2026-63248, ensure that access authorization is properly enforced for diagnostics nodes in Eclipse Milo.
Which versions of Eclipse Milo are affected by CVE-2026-63248?
CVE-2026-63248 affects Eclipse Milo versions 0.6.0 through 1.1.4.
What does CVE-2026-63248 vulnerability allow an attacker to do?
CVE-2026-63248 allows an anonymous client to enable diagnostics without proper access authorization.
Is there a patch available for CVE-2026-63248?
At this time, please refer to the Eclipse Milo repository for any available patches addressing CVE-2026-63248.