CVE-2026-35063: OpenPLC_V3 Privilege Escalation Flaw

CVE-2026-35063 Overview

CVE-2026-35063 is a critical authorization bypass vulnerability affecting OpenPLC_V3, an open-source programmable logic controller (PLC) platform commonly deployed in industrial control system (ICS) environments. The vulnerability exists in the REST API endpoint, which checks for JWT (JSON Web Token) presence but fails to verify the caller's role, resulting in a broken access control condition (CWE-862: Missing Authorization).

Any authenticated user with a standard role=user privilege can exploit this vulnerability to delete any other user, including administrators, by specifying their user ID. Additionally, attackers can create new accounts with role=admin, effectively escalating to full administrator access over the PLC system.

Critical Impact
This vulnerability enables authenticated users to escalate privileges to administrator level or delete critical accounts, potentially leading to complete compromise of industrial control systems and operational technology (OT) environments.

Affected Products

OpenPLC_V3 (versions not specified in advisory)
Industrial control systems utilizing OpenPLC_V3 REST API
OT environments deploying OpenPLC_V3 for PLC management

Discovery Timeline

April 9, 2026 - CVE-2026-35063 published to NVD
April 9, 2026 - Last updated in NVD database

Technical Details for CVE-2026-35063

Vulnerability Analysis

The vulnerability stems from a fundamental flaw in the authorization implementation of the OpenPLC_V3 REST API. While the application correctly validates that a JWT token is present in API requests, it fails to perform role-based access control (RBAC) verification before executing sensitive administrative operations.

This missing authorization check allows any authenticated user—regardless of their assigned role—to invoke administrative functions such as user deletion and user creation with elevated privileges. The vulnerability is particularly severe in industrial environments where OpenPLC_V3 manages critical infrastructure components.

The network-accessible nature of this vulnerability, combined with low attack complexity and no user interaction required, makes it highly exploitable once an attacker obtains basic authentication credentials to the system.

Root Cause

The root cause is CWE-862: Missing Authorization. The REST API endpoint implementation performs authentication verification (checking JWT presence) but completely omits the authorization step (verifying the caller's role matches the required privilege level for the requested operation). This architectural flaw in access control design allows privilege boundaries to be bypassed.

Attack Vector

The attack can be executed remotely over the network by any authenticated user. The attack sequence involves:

An attacker authenticates to OpenPLC_V3 with valid low-privilege credentials (standard user account)
The attacker crafts API requests to administrative endpoints, including their valid JWT token
The API validates the JWT is present but does not check if the user role permits the action
The attacker can delete administrator accounts by specifying the target user ID
Alternatively, the attacker can create a new account with role=admin privileges
The attacker now has full administrative control over the OpenPLC_V3 system

The vulnerability requires only low-privilege credentials to exploit, which could be obtained through credential theft, social engineering, or compromise of any standard user account.

Detection Methods for CVE-2026-35063

Indicators of Compromise

Unexpected user account deletions in OpenPLC_V3, particularly administrator accounts
Creation of new administrator accounts by users with standard privileges
Anomalous API activity from user accounts accessing administrative endpoints
Audit logs showing privilege escalation patterns or unauthorized role modifications

Detection Strategies

Monitor OpenPLC_V3 API access logs for requests to user management endpoints from non-administrative accounts
Implement alerting on any user creation with role=admin that does not originate from known administrative sessions
Deploy network intrusion detection signatures to identify API calls targeting user deletion or creation endpoints
Correlate authentication logs with administrative action logs to detect privilege boundary violations

Monitoring Recommendations

Enable comprehensive logging on all OpenPLC_V3 REST API endpoints
Establish baseline behavior for administrative operations and alert on deviations
Monitor for rapid successive API calls to user management functions
Implement real-time alerting for any changes to administrator accounts in ICS/OT environments

How to Mitigate CVE-2026-35063

Immediate Actions Required

Review all user accounts in OpenPLC_V3 deployments for unauthorized administrator accounts
Audit recent API activity logs for signs of exploitation
Implement network segmentation to restrict access to OpenPLC_V3 REST API endpoints
Consider temporary disablement of remote API access until patches are applied
Apply principle of least privilege to all user accounts

Patch Information

Consult the CISA ICS Advisory ICSA-25-345-10 for official vendor guidance and patch availability. Organizations should monitor the OpenPLC project for security updates addressing this authorization bypass vulnerability.

Workarounds

Implement network-level access controls to restrict REST API access to trusted IP addresses only
Deploy a web application firewall (WAF) with rules to block unauthorized administrative API requests
Implement additional authentication layers (MFA) for all OpenPLC_V3 user accounts
Consider placing OpenPLC_V3 systems behind a reverse proxy that enforces role-based access control at the network boundary
Temporarily disable user management API endpoints if not operationally required

Organizations operating OpenPLC_V3 in critical infrastructure environments should treat this vulnerability with high priority and implement defense-in-depth measures until an official patch is available.