CVE-2026-67864: open62541 Denial of Service Vulnerability

CVE-2026-67864 Overview

CVE-2026-67864 is a denial-of-service vulnerability affecting open62541 version 1.5.5 and earlier. The open62541 library is a widely used open-source implementation of the OPC Unified Architecture (OPC UA) protocol for industrial automation and Internet of Things (IoT) deployments. The flaw resides in the NodeManagement type-instantiation logic component. A remote attacker can trigger the condition to disrupt server availability. See GitHub Issue #8133 for the upstream discussion.

Critical Impact
A remote attacker can cause a denial of service against OPC UA servers built on open62541 v1.5.5 and earlier by abusing the type-instantiation path inside the NodeManagement service.

Affected Products

open62541 version 1.5.5
open62541 versions prior to 1.5.5
OPC UA servers built on the affected open62541 library releases

Discovery Timeline

2026-08-05 - CVE-2026-67864 published to the National Vulnerability Database (NVD)
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-67864

Vulnerability Analysis

The vulnerability exists in the type-instantiation logic of the NodeManagement service inside open62541. NodeManagement handles requests that add, delete, or reference nodes in the OPC UA address space. During type instantiation, the server materializes new node instances from a supplied TypeDefinition and copies structural children based on the referenced type hierarchy. A remote attacker can trigger a fault condition in this path that halts or crashes the server process. Because OPC UA servers typically anchor real-time industrial workflows, loss of availability degrades control, monitoring, and telemetry across dependent devices. The affected source path is ua_services_nodemanagement.c in the v1.5.5 tree.

Root Cause

The defect lies in how the NodeManagement service processes type-instantiation input during node-add operations. Insufficient validation of the instantiation state or the referenced type hierarchy allows a malformed request to place the service into an unrecoverable state. Refer to the reported behavior in GitHub Issue #8133 for reproduction details.

Attack Vector

The attack vector is remote across the network. An attacker who can reach the OPC UA endpoint sends a crafted node-management request. Deployments that rely on the default access-control plugin, defined in ua_accesscontrol_default.c, and configurations similar to the shipped ci_server.c example are within scope where the AddNodes service is exposed to authenticated or anonymous sessions.

No verified public proof-of-concept is linked from the NVD record. The vulnerability is described here in prose because no vetted exploit code is available.

Detection Methods for CVE-2026-67864

Indicators of Compromise

Unexpected termination or restarts of OPC UA server processes running open62541 v1.5.5 or earlier.
Bursts of AddNodes or type-instantiation requests originating from unusual source addresses.
Session logs showing malformed NodeManagement requests immediately prior to a service outage.

Detection Strategies

Inventory all deployed open62541 binaries and match against version 1.5.5 and prior to identify exposure.
Enable verbose server logging for the NodeManagement service and alert on repeated failures in type-instantiation handling.
Correlate OPC UA endpoint availability with network telemetry to identify remote sources triggering crashes.

Monitoring Recommendations

Monitor TCP port 4840 and any custom OPC UA endpoint ports for anomalous request patterns.
Track OPC UA server process uptime and generate alerts on unplanned restarts.
Capture full session metadata for AddNodes calls, including source identity, TypeDefinition node IDs, and request frequency.

How to Mitigate CVE-2026-67864

Immediate Actions Required

Identify every service that links against open62541 v1.5.5 or earlier and prioritize patching.
Restrict network reachability of OPC UA endpoints to trusted operational technology (OT) segments only.
Disable anonymous access on OPC UA servers and require authenticated sessions for node-management operations.
Rate-limit or block AddNodes requests at network chokepoints where feasible.

Patch Information

Refer to the open62541 project on GitHub for the latest fix status and post-1.5.5 releases. Upgrade to a fixed release once published by the maintainers and rebuild dependent applications against the patched library.

Workarounds

Tighten the access-control plugin so that only privileged sessions can call AddNodes and related NodeManagement services.
Segment OPC UA servers behind firewalls that allow inbound connections only from known OPC UA clients.
Deploy an OPC UA-aware gateway or proxy that validates and rate-limits NodeManagement requests before they reach the server.

bash

# Configuration example: restrict OPC UA endpoint exposure with iptables
# Allow OPC UA (port 4840) only from a trusted OT management subnet
iptables -A INPUT -p tcp --dport 4840 -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 4840 -j DROP