CVE-2026-67870 Overview
CVE-2026-67870 affects open62541 v1.5.5, an open-source implementation of the OPC Unified Architecture (OPC UA) protocol used in industrial automation and IoT deployments. The server-side AddReferences implementation contains an incomplete validation flaw when processing non-local ExpandedNodeId targets. A remote attacker can send a crafted AddReferencesRequest with an empty targetServerUri and a non-zero targetNodeId.serverIndex. This condition causes the target node pointer to remain NULL while server execution continues, leading to a null pointer dereference in downstream code paths.
Critical Impact
Remote attackers can trigger a null pointer dereference in the OPC UA server through a malformed AddReferences request, causing a denial of service on industrial control endpoints.
Affected Products
- open62541 v1.5.5
- OPC UA server deployments built on the affected open62541 release
- Industrial and IoT applications embedding the open62541 stack
Discovery Timeline
- 2026-08-06 - CVE-2026-67870 published to NVD
- 2026-08-06 - Last updated in NVD database
Technical Details for CVE-2026-67870
Vulnerability Analysis
The flaw resides in the server-side node management logic implemented in src/server/ua_services_nodemanagement.c. When the server processes an AddReferencesRequest, each reference item contains a targetNodeId of type ExpandedNodeId. This structure carries an optional namespaceUri, a nodeId, and a serverIndex field. A non-zero serverIndex indicates the target node lives on a remote server rather than the local address space.
The validation path fails to reject requests where serverIndex is non-zero but targetServerUri is empty. Instead of rejecting the request, the server proceeds with a NULL target node pointer and continues executing reference-addition logic that assumes a valid pointer. The condition maps to a null pointer dereference class flaw and is tracked in the project as GitHub Issue #8172.
Root Cause
The root cause is incomplete input validation on the ExpandedNodeId structure defined in types.h. The server accepts a semantically inconsistent combination of fields. Logic in ua_services_nodemanagement.c does not enforce that a non-zero serverIndex requires a corresponding non-empty targetServerUri, so the target lookup returns NULL without aborting the operation.
Attack Vector
An unauthenticated or authenticated remote client with the ability to reach the OPC UA server endpoint sends an AddReferencesRequest carrying an AddReferencesItem. The attacker sets targetNodeId.serverIndex to a non-zero value and leaves targetServerUri as an empty string. The server accepts the request, fails to resolve a real target node, and dereferences the resulting NULL pointer. The vulnerability requires network reachability to the OPC UA service port and a client capable of issuing AddReferences service calls.
No verified public exploit code is available. Refer to the upstream references linked above for the affected code paths, including ua_types.c for the ExpandedNodeId handling.
Detection Methods for CVE-2026-67870
Indicators of Compromise
- Unexpected crashes or restarts of OPC UA server processes built on open62541 v1.5.5
- AddReferencesRequest messages containing an empty targetServerUri combined with a non-zero targetNodeId.serverIndex
- Repeated inbound OPC UA sessions from unusual client endpoints targeting node management services
Detection Strategies
- Inspect OPC UA traffic for AddReferencesRequest service calls and flag messages where serverIndex is non-zero but targetServerUri is empty
- Correlate server-side segmentation faults or null pointer dereference core dumps with recent inbound OPC UA sessions
- Alert on OPC UA service disruptions on operational technology (OT) network segments where availability is critical
Monitoring Recommendations
- Enable verbose logging on the open62541 server for node management service calls and audit AddReferences operations
- Monitor process supervision logs for repeated restarts of OPC UA server binaries
- Track network flows between engineering workstations and OPC UA endpoints to establish a baseline for anomalous AddReferences activity
How to Mitigate CVE-2026-67870
Immediate Actions Required
- Inventory all deployments running open62541 v1.5.5 and identify exposed OPC UA endpoints
- Restrict network access to OPC UA server ports to trusted engineering workstations and controllers
- Enforce authentication and message signing on OPC UA channels to reduce the pool of clients able to issue AddReferences requests
- Monitor upstream project releases for a fixed version addressing GitHub Issue #8172
Patch Information
At the time of publication, the enriched CVE data does not list a fixed release. Track the upstream open62541 repository and the referenced issue for an official patch. Apply the fix as soon as it is available and validate that the server rejects AddReferencesRequest messages containing a non-zero serverIndex with an empty targetServerUri.
Workarounds
- Block or filter OPC UA AddReferences service calls at a protocol-aware gateway when they originate from untrusted networks
- Segment OPC UA servers onto isolated OT VLANs with strict inbound access control lists
- Deploy protocol-aware intrusion prevention rules to drop malformed ExpandedNodeId structures where serverIndex is set but targetServerUri is empty
- Restart supervision and health-check policies to recover the server automatically if a crash is triggered while a patch is pending
# Configuration example: restrict access to the OPC UA endpoint (default TCP/4840)
iptables -A INPUT -p tcp --dport 4840 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 4840 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
