CVE-2026-63248: Eclipse Milo Eclipse Milo vulnerability
In Eclipse Milo versions 0.6.0 through 1.1.4, OPC UA server diagnostics nodes do not enforce access authorization. An anonymous client can enable diagnostics over a None/None endpoint without a certificate; with a trusted client application certificate over SignAndEncrypt, it can read security diagnostics for other active sessions, exposing usernames, login history, authentication mechanisms, security modes and policies, and public client certificates.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict/disable the ability for anonymous clients to enable diagnostics over the None/None endpoint without a certificate; ensure diagnostics endpoints require certificate-based authenticated clients (e.g., require client certificates and enforce authorization on diagnostics access).
- Compensating control
Enforce access authorization for OPC UA server diagnostics nodes so they do not allow anonymous or cross-session reads of security diagnostics (usernames, login history, authentication mechanisms, security modes/policies, and public client certificates).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-63248?
The severity of CVE-2026-63248 is rated as 57.
How do I fix CVE-2026-63248?
To fix CVE-2026-63248, ensure that access authorization is properly enforced for diagnostics nodes in Eclipse Milo.
Which versions of Eclipse Milo are affected by CVE-2026-63248?
CVE-2026-63248 affects Eclipse Milo versions 0.6.0 through 1.1.4.
What does CVE-2026-63248 vulnerability allow an attacker to do?
CVE-2026-63248 allows an anonymous client to enable diagnostics without proper access authorization.
Is there a patch available for CVE-2026-63248?
At this time, please refer to the Eclipse Milo repository for any available patches addressing CVE-2026-63248.