CVE-2026-60007: Eclipse Milo Auth Bypass Vulnerability

CVE-2026-60007 Overview

CVE-2026-60007 is a padding oracle vulnerability in Eclipse Milo, an open-source OPC UA (Open Platform Communications Unified Architecture) stack widely deployed in industrial automation and IIoT environments. Versions 0.6.0 through 1.1.4 return distinguishable errors during username-token processing, differentiating between invalid RSA PKCS#1 v1.5 padding and other authentication failures. An on-path attacker who captures a victim's Basic128Rsa15-encrypted username token can issue repeated unauthenticated ActivateSession requests to build a padding oracle, recover the plaintext password, and authenticate as the victim.

Critical Impact
Attackers with network position can decrypt captured OPC UA credentials and impersonate legitimate users on industrial control systems.

Affected Products

Eclipse Milo 0.6.0 through 1.1.4
OPC UA servers using the Basic128Rsa15 security policy with username-token authentication
Downstream products embedding vulnerable Eclipse Milo releases

Discovery Timeline

2026-08-04 - CVE-2026-60007 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-60007

Vulnerability Analysis

Eclipse Milo's AbstractUsernameIdentityValidator decrypts client-supplied username tokens when the negotiated security policy is not None. When the Basic128Rsa15 policy is used, passwords arrive encrypted with RSA PKCS#1 v1.5. The decryption routine raised distinct exceptions for malformed padding compared to other identity-token errors, and those distinctions propagated back to the client as different StatusCode values on ActivateSession responses.

This behavior matches the classic Bleichenbacher pattern classified under [CWE-204: Observable Response Discrepancy]. An attacker who intercepts a ciphertext blob can submit modified variants and use the server's response as a one-bit oracle for PKCS#1 v1.5 validity, iteratively recovering the plaintext password.

Root Cause

The validator invoked decryptTokenData and allowed the underlying UaException to surface with padding-specific status codes. The fix collapses all decryption failures into a single generic Bad_IdentityTokenInvalid response, removing the side channel.

Attack Vector

Exploitation requires network reachability to the OPC UA server and passive capture of at least one legitimate encrypted username token. ActivateSession requests do not require prior authentication, so the attacker can issue thousands of oracle queries without credentials. Successful recovery yields the victim's cleartext password.

java

// Patch: opc-ua-sdk/sdk-server/.../AbstractUsernameIdentityValidator.java
     byte[] tokenBytes = token.getPassword().bytesOrEmpty();
 
     if (algorithm != SecurityAlgorithm.None) {
-      byte[] plainTextBytes = decryptTokenData(session, algorithm, tokenBytes);
+      byte[] plainTextBytes;
+
+      try {
+        plainTextBytes = decryptTokenData(session, algorithm, tokenBytes);
+      } catch (UaException ignored) {
+        throw new UaException(StatusCodes.Bad_IdentityTokenInvalid);
+      }
 
       if (plainTextBytes.length < 4) {
         throw new UaException(StatusCodes.Bad_IdentityTokenInvalid, "invalid token data");

Source: Eclipse Milo commit db59fae

Detection Methods for CVE-2026-60007

Indicators of Compromise

High-volume ActivateSession requests from a single source IP with mismatched or malformed username tokens
Repeated Bad_IdentityTokenInvalid or padding-related status codes correlated to one client session
Anomalous session activation attempts against OPC UA endpoints exposing the Basic128Rsa15 security policy

Detection Strategies

Baseline normal ActivateSession request rates per client and alert on statistical outliers indicative of oracle probing
Inspect server logs for bursts of failed username-token decryptions preceding a successful authentication from a new IP
Deploy network sensors that parse OPC UA binary protocol traffic and flag automated token permutation patterns

Monitoring Recommendations

Forward Eclipse Milo server logs into a SIEM or data lake for correlation across sessions and endpoints
Track authentication successes that follow sustained failure bursts from the same peer within a short window
Monitor egress from operator workstations for unexpected OPC UA client tooling that could stage on-path capture

How to Mitigate CVE-2026-60007

Immediate Actions Required

Upgrade Eclipse Milo to a fixed release beyond 1.1.4 that includes commit db59fae
Disable the Basic128Rsa15 security policy on all OPC UA endpoints and enforce Basic256Sha256 or Aes256_Sha256_RsaPss
Rotate any passwords transmitted through Basic128Rsa15-protected sessions, treating them as potentially exposed

Patch Information

The fix is committed in the Eclipse Milo repository at commit db59fae993a3a1bc66fffc8a2796d444b40285fb and tracked in the Eclipse GitLab vulnerability report #598. CVE assignment details are recorded in GitLab work item #183. Rebuild and redistribute downstream products that embed the Milo SDK.

Workarounds

Remove Basic128Rsa15 from the server's SecurityPolicies list and require certificate-based user tokens where feasible
Restrict OPC UA endpoint exposure to trusted management VLANs and terminate untrusted network paths
Enforce mutual TLS or VPN tunnels between OPC UA clients and servers to defeat on-path capture

bash

# Example: enforce stronger OPC UA security policies at the server configuration layer
opcua.server.securityPolicies=Basic256Sha256,Aes256_Sha256_RsaPss
opcua.server.userTokenPolicies=UserName:Basic256Sha256,Certificate:Basic256Sha256
opcua.server.allowAnonymous=false