CVE-2026-62927: Eclipse Milo Auth Bypass Vulnerability

CVE-2026-62927 Overview

CVE-2026-62927 is an authorization bypass vulnerability [CWE-863] affecting Eclipse Milo versions 1.0.0 through 1.1.4. Eclipse Milo is an open-source implementation of the OPC Unified Architecture (OPC UA) protocol used in industrial automation environments. The Call service dispatches the original mixed batch to address-space handlers after calculating authorization. This flaw allows an anonymous or otherwise low-privileged client to execute a denied method by batching it with an allowed method. The vulnerability affects the integrity of OPC UA server operations without requiring authentication or user interaction.

Critical Impact
Unauthenticated network attackers can invoke restricted OPC UA methods on Eclipse Milo servers by piggybacking denied calls onto authorized batch requests, undermining access control in industrial systems.

Affected Products

Eclipse Milo 1.0.0 through 1.1.4
OPC UA servers built on the affected eclipse:milo SDK component
Industrial automation deployments exposing the Milo Call service to untrusted clients

Discovery Timeline

2026-08-04 - CVE-2026-62927 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-62927

Vulnerability Analysis

The vulnerability resides in the DefaultMethodServiceSet implementation of the Eclipse Milo OPC UA server. When a client submits a Call request containing multiple methods, the server evaluates authorization for each method individually. However, after that evaluation, the server dispatches the original unfiltered batch, methodsToCall, to the address-space handlers instead of the authorized subset. As a result, denied methods remain in the dispatched batch and execute alongside allowed ones. This is a classic incorrect authorization enforcement pattern where the decision is computed but not applied to the enforcement path.

Root Cause

The root cause is a check-versus-use gap in DefaultMethodServiceSet.java. Authorization results are calculated per method and grouped into an authorized set, but the server passes the original methodsToCall collection to AddressSpaceManager.call(). The filtered group collection representing only authorized methods is never used. This maps to [CWE-863] Incorrect Authorization.

Attack Vector

An unauthenticated remote attacker connects to an exposed Milo OPC UA endpoint and issues a Call service request containing a batch of methods. The batch mixes at least one method the anonymous session is permitted to call with one or more methods that should be denied. The server computes deny decisions but still dispatches every method in the original batch, causing the restricted methods to execute.

java

                             request.getRequestHeader().getTimeoutHint(),
                             request.getRequestHeader().getAdditionalHeader());
 
-                    return server.getAddressSpaceManager().call(callContext, methodsToCall);
+                    return server.getAddressSpaceManager().call(callContext, group);
                   }
                 });

Source: Eclipse Milo commit 59b50be. The patch replaces the unfiltered methodsToCall argument with the authorized group collection, ensuring only permitted methods reach the address-space handlers.

Detection Methods for CVE-2026-62927

Indicators of Compromise

Anonymous or low-privileged OPC UA sessions issuing Call service requests with multiple CallMethodRequest entries in a single batch.
Successful method invocations on nodes that should be restricted by role or user permission policies.
Unexpected state changes on the Milo server address space originating from sessions without matching authorization.

Detection Strategies

Enable OPC UA audit logging on Milo servers and alert on Call requests where the requesting session lacks the role required by the invoked method's UserRolePermissions.
Correlate batched Call requests against per-method authorization decisions to identify dispatches that exceed the caller's granted permissions.
Inventory Milo deployments and flag any instance reporting a version between 1.0.0 and 1.1.4.

Monitoring Recommendations

Forward Milo server logs to a centralized SIEM and build detections for anomalous method invocations from anonymous sessions.
Monitor network traffic to OPC UA TCP port 4840 for repeated Call requests from untrusted network segments.
Track process control side effects on downstream industrial systems that may indicate unauthorized method execution.

How to Mitigate CVE-2026-62927

Immediate Actions Required

Upgrade Eclipse Milo to a version that includes commit 59b50be (post 1.1.4) as soon as it is available from the project.
Restrict network access to Milo OPC UA endpoints so only trusted engineering workstations and control systems can reach the Call service.
Disable anonymous user token policies on production Milo servers and require certificate or username authentication.

Patch Information

The fix is committed in the Eclipse Milo repository as commit 59b50bed094de0d18a130a48f3527254dc76105d under pull request #1802. The patch changes DefaultMethodServiceSet to dispatch only the authorized group of methods to AddressSpaceManager.call(). Additional details are available in the Eclipse Vulnerability Report 598 and the Eclipse CVE Assignment 178.

Workarounds

Reject Call service requests containing more than one CallMethodRequest at an application-layer proxy until the server is patched.
Remove or tighten UserRolePermissions on sensitive methods so that no anonymous or low-privileged role can pass the per-method authorization check.
Segment Milo servers behind firewalls or industrial DMZs to prevent unauthenticated network reachability from IT or external networks.

bash

# Example firewall rule limiting OPC UA access to a trusted engineering subnet
iptables -A INPUT -p tcp --dport 4840 -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 4840 -j DROP