CVE-2026-63248 Overview
CVE-2026-63248 is a missing authorization vulnerability [CWE-862] in Eclipse Milo, an open-source implementation of the OPC Unified Architecture (OPC UA) protocol stack. Affected versions 0.6.0 through 1.1.4 fail to enforce access authorization on OPC UA server diagnostics nodes. An anonymous client can enable diagnostics through a None/None endpoint without presenting a certificate. A client authenticated with a trusted application certificate over SignAndEncrypt can then read security diagnostics belonging to other active sessions. Exposed data includes usernames, login history, authentication mechanisms, security modes and policies, and public client certificates.
Critical Impact
Attackers can enumerate session-level security diagnostics across an OPC UA server, exposing credentials metadata, authentication methods, and client certificates that support follow-on identity attacks against industrial control environments.
Affected Products
- Eclipse Milo 0.6.0 through 1.1.4
- OPC UA servers built on the eclipse:milo SDK
- Downstream industrial applications embedding the Milo sdk-server component
Discovery Timeline
- 2026-08-04 - CVE-2026-63248 published to the National Vulnerability Database (NVD)
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-63248
Vulnerability Analysis
Eclipse Milo exposes standard OPC UA diagnostic objects, including SessionDiagnosticsArray and SessionSecurityDiagnosticsArray, under the server address space. These nodes are meant to be restricted to privileged clients, but the affected releases do not enforce authorization on reads. Two conditions compound the impact.
First, the server accepts an anonymous connection over a None security policy with no message security, and this session can toggle the diagnostics enable flag on the server. Second, once diagnostics are enabled, any client presenting a trusted application instance certificate over SignAndEncrypt can browse and read SessionSecurityDiagnostics for every active session. The data disclosed includes usernames, authentication mechanisms, security modes, security policies, client certificates, and login history. This information supports credential targeting and downstream impersonation against operational technology (OT) systems.
Root Cause
The root cause is missing authorization on session security diagnostic nodes. The OpcUaServerConfig class did not expose an access-mode control for SessionSecurityDiagnostics, so read access was governed only by transport-level checks rather than a per-session authorization decision. The upstream fix introduces a SessionSecurityDiagnosticsAccessMode configuration setting that restricts which sessions can observe security diagnostics for others.
Attack Vector
Exploitation is remote and unauthenticated for the enable step. An attacker with network reachability to the OPC UA endpoint connects anonymously over None/None and enables server diagnostics. With a trusted application certificate, common in interoperability deployments, the attacker then reads security diagnostics for other sessions across the SignAndEncrypt channel. See the GitLab Vulnerability Report #598 for the full disclosure.
// Patch excerpt: OpcUaServerConfig.java introduces access-mode control
import java.util.concurrent.ExecutorService;
import java.util.concurrent.ScheduledExecutorService;
import java.util.function.Consumer;
import org.eclipse.milo.opcua.sdk.server.diagnostics.SessionSecurityDiagnosticsAccessMode;
import org.eclipse.milo.opcua.sdk.server.identity.AnonymousIdentityValidator;
import org.eclipse.milo.opcua.sdk.server.identity.CompositeValidator;
import org.eclipse.milo.opcua.sdk.server.identity.IdentityValidator;
Source: GitHub Commit a5dae1b
// Patch excerpt: OpcUaServerConfigBuilder.java wires the new access mode
package org.eclipse.milo.opcua.sdk.server;
import static java.util.Objects.requireNonNull;
import java.util.HashSet;
import java.util.Optional;
import java.util.Set;
import java.util.concurrent.ExecutorService;
import java.util.concurrent.ScheduledExecutorService;
import org.eclipse.milo.opcua.sdk.server.diagnostics.SessionSecurityDiagnosticsAccessMode;
import org.eclipse.milo.opcua.sdk.server.identity.AnonymousIdentityValidator;
import org.eclipse.milo.opcua.sdk.server.identity.IdentityValidator;
import org.eclipse.milo.opcua.stack.core.Stack;
Source: GitHub Commit a5dae1b
Detection Methods for CVE-2026-63248
Indicators of Compromise
- Anonymous OPC UA sessions established against a None/None endpoint that then write to the server diagnostics enable node.
- Unexpected reads of SessionSecurityDiagnosticsArray or SessionSecurityDiagnostics objects by non-administrative clients.
- Multiple sessions from a single client certificate enumerating diagnostic nodes across a short interval.
Detection Strategies
- Enable OPC UA server audit events and log all Write operations against server diagnostics enable variables.
- Alert on any Browse or Read requests targeting SessionSecurityDiagnostics nodes originating from non-administrative identities.
- Correlate anonymous session creation with subsequent diagnostic node access from the same source IP or certificate thumbprint.
Monitoring Recommendations
- Forward OPC UA audit logs to a centralized SIEM or data lake for cross-session analysis.
- Baseline the certificate thumbprints and identities that legitimately access diagnostic nodes, then alert on deviations.
- Monitor OT network segments for new inbound connections to port 4840 or vendor-specific OPC UA ports from unexpected hosts.
How to Mitigate CVE-2026-63248
Immediate Actions Required
- Upgrade Eclipse Milo to the patched release that includes commit a5dae1b restricting session security diagnostics access.
- Disable anonymous authentication and remove None/None endpoints where the deployment does not require them.
- Restrict which application instance certificates are trusted, and revoke certificates issued for testing or interoperability that are no longer in use.
Patch Information
The fix is delivered in the upstream commit a5dae1be0657d2b4fcb66e63f377c1dc36069e2a, which introduces SessionSecurityDiagnosticsAccessMode and wires it into OpcUaServerConfig and OpcUaServerConfigBuilder. Track the disclosure at GitLab CVE Assignment #181 and confirm your build ingests a Milo release later than 1.1.4.
Workarounds
- Configure the server to expose only SignAndEncrypt endpoints and require user identity tokens beyond anonymous.
- Set the diagnostics enable flag to false at server startup and restrict write access on the corresponding node to administrative identities.
- Segment OPC UA servers behind an OT firewall so that only vetted supervisory clients can reach the endpoint.
# Configuration example: enforce non-anonymous, encrypted sessions
# opcua-server.conf
endpoint.security.policies=Basic256Sha256,Aes256_Sha256_RsaPss
endpoint.message.security.modes=SignAndEncrypt
authentication.anonymous.enabled=false
diagnostics.enabled.default=false
diagnostics.security.access-mode=RESTRICTED
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
