CVE-2026-35063: OpenPLC_V3 Privilege Escalation Flaw

CVE-2026-35063 Overview

CVE-2026-35063 is a critical authorization bypass vulnerability affecting OpenPLC_V3, an open-source programmable logic controller (PLC) platform commonly deployed in industrial control system (ICS) environments. The vulnerability exists in the REST API endpoint, which checks for JWT (JSON Web Token) presence but fails to verify the caller's role, resulting in a broken access control condition (CWE-862: Missing Authorization).

Any authenticated user with a standard role=user privilege can exploit this vulnerability to delete any other user, including administrators, by specifying their user ID. Additionally, attackers can create new accounts with role=admin, effectively escalating to full administrator access over the PLC system.

Critical Impact

This vulnerability enables authenticated users to escalate privileges to administrator level or delete critical accounts, potentially leading to complete compromise of industrial control systems and operational technology (OT) environments.

Affected Products

• OpenPLC_V3 (versions not specified in advisory)
• Industrial control systems utilizing OpenPLC_V3 REST API
• OT environments deploying OpenPLC_V3 for PLC management

Discovery Timeline

• April 9, 2026 - CVE-2026-35063 published to NVD
• April 9, 2026 - Last updated in NVD database

Technical Details for CVE-2026-35063

Vulnerability Analysis

The vulnerability stems from a fundamental flaw in the authorization implementation of the OpenPLC_V3 REST API. While the application correctly validates that a JWT token is present in API requests, it fails to perform role-based access control (RBAC) verification before executing sensitive administrative operations.

This missing authorization check allows any authenticated user—regardless of their assigned role—to invoke administrative functions such as user deletion and user creation with elevated privileges. The vulnerability is particularly severe in industrial environments where OpenPLC_V3 manages critical infrastructure components.

The network-accessible nature of this vulnerability, combined with low attack complexity and no user interaction required, makes it highly exploitable once an attacker obtains basic authentication credentials to the system.

Root Cause

The root cause is CWE-862: Missing Authorization. The REST API endpoint implementation performs authentication verification (checking JWT presence) but completely omits the authorization step (verifying the caller's role matches the required privilege level for the requested operation). This architectural flaw in access control design allows privilege boundaries to be bypassed.

Attack Vector

The attack can be executed remotely over the network by any authenticated user. The attack sequence involves:

1. An attacker authenticates to OpenPLC_V3 with valid low-privilege credentials (standard user account)
2. The attacker crafts API requests to administrative endpoints, including their valid JWT token
3. The API validates the JWT is present but does not check if the user role permits the action
4. The attacker can delete administrator accounts by specifying the target user ID
5. Alternatively, the attacker can create a new account with role=admin privileges
6. The attacker now has full administrative control over the OpenPLC_V3 system

The vulnerability requires only low-privilege credentials to exploit, which could be obtained through credential theft, social engineering, or compromise of any standard user account.

Detection Methods for CVE-2026-35063

Indicators of Compromise

• Unexpected user account deletions in OpenPLC_V3, particularly administrator accounts
• Creation of new administrator accounts by users with standard privileges
• Anomalous API activity from user accounts accessing administrative endpoints
• Audit logs showing privilege escalation patterns or unauthorized role modifications

Detection Strategies

• Monitor OpenPLC_V3 API access logs for requests to user management endpoints from non-administrative accounts
• Implement alerting on any user creation with role=admin that does not originate from known administrative sessions
• Deploy network intrusion detection signatures to identify API calls targeting user deletion or creation endpoints
• Correlate authentication logs with administrative action logs to detect privilege boundary violations

Monitoring Recommendations

• Enable comprehensive logging on all OpenPLC_V3 REST API endpoints
• Establish baseline behavior for administrative operations and alert on deviations
• Monitor for rapid successive API calls to user management functions
• Implement real-time alerting for any changes to administrator accounts in ICS/OT environments

How to Mitigate CVE-2026-35063

Immediate Actions Required

• Review all user accounts in OpenPLC_V3 deployments for unauthorized administrator accounts
• Audit recent API activity logs for signs of exploitation
• Implement network segmentation to restrict access to OpenPLC_V3 REST API endpoints
• Consider temporary disablement of remote API access until patches are applied
• Apply principle of least privilege to all user accounts

Patch Information

Consult the CISA ICS Advisory ICSA-25-345-10 for official vendor guidance and patch availability. Organizations should monitor the OpenPLC project for security updates addressing this authorization bypass vulnerability.

Workarounds

• Implement network-level access controls to restrict REST API access to trusted IP addresses only
• Deploy a web application firewall (WAF) with rules to block unauthorized administrative API requests
• Implement additional authentication layers (MFA) for all OpenPLC_V3 user accounts
• Consider placing OpenPLC_V3 systems behind a reverse proxy that enforces role-based access control at the network boundary
• Temporarily disable user management API endpoints if not operationally required

Organizations operating OpenPLC_V3 in critical infrastructure environments should treat this vulnerability with high priority and implement defense-in-depth measures until an official patch is available.