CVE-2026-63248

In Eclipse Milo versions 0.6.0 through 1.1.4, OPC UA server diagnostics nodes do not enforce access authorization. An anonymous client can enable diagnostics over a None/None endpoint without a certificate; with a trusted client application certificate over SignAndEncrypt, it can read security diagnostics for other active sessions, exposing usernames, login history, authentication mechanisms, security modes and policies, and public client certificates.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/eclipse-milo/milo/commit/a5dae1be0657d2b4fcb66e63f377c1dc36069e2a	Patch
https://gitlab.eclipse.org/security/cve-assignment/-/work_items/181	Issue Tracking Patch Vendor Advisory
https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/598	Issue Tracking Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:eclipse:milo:*:*:*:*:*:*:*:*

History

23 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) En las versiones 0.6.0 a 1.1.4 de Eclipse Milo, los nodos de diagnóstico del servidor OPC UA no aplican la autorización de acceso. Un cliente anónimo puede habilitar los diagnósticos a través de un endpoint None/None sin un certificado; con un certificado de aplicación de cliente de confianza a través de SignAndEncrypt, puede leer los diagnósticos de seguridad de otras sesiones activas, exponiendo nombres de usuario, historial de inicio de sesión, mecanismos de autenticación, modos y políticas de seguridad, y certificados de cliente públicos.

Information

Published : 2026-08-04 13:18

Updated : 2026-10-23 23:10

NVD link : CVE-2026-63248

Mitre link : CVE-2026-63248

CVE.ORG link : CVE-2026-63248

JSON object : View

Products Affected

eclipse

milo

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-63248", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-63248", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-04T14:28:14.505853Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "emo@eclipse.org", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "emo@eclipse.org", "affectedData": [{"vendor": "Eclipse Foundation", "product": "Eclipse Milo", "versions": [{"status": "affected", "version": "0.6.0", "versionType": "semver", "lessThanOrEqual": "1.1.4"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-04T13:18:55.790", "references": [{"url": "https://github.com/eclipse-milo/milo/commit/a5dae1be0657d2b4fcb66e63f377c1dc36069e2a", "tags": ["Patch"], "source": "emo@eclipse.org"}, {"url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/181", "tags": ["Issue Tracking", "Patch", "Vendor Advisory"], "source": "emo@eclipse.org"}, {"url": "https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/598", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "emo@eclipse.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "emo@eclipse.org", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "In Eclipse Milo versions 0.6.0 through 1.1.4, OPC UA server diagnostics nodes do not enforce access authorization. An anonymous client can enable diagnostics over a None/None endpoint without a certificate; with a trusted client application certificate over SignAndEncrypt, it can read security diagnostics for other active sessions, exposing usernames, login history, authentication mechanisms, security modes and policies, and public client certificates."}, {"lang": "es", "value": "En las versiones 0.6.0 a 1.1.4 de Eclipse Milo, los nodos de diagn\u00f3stico del servidor OPC UA no aplican la autorizaci\u00f3n de acceso. Un cliente an\u00f3nimo puede habilitar los diagn\u00f3sticos a trav\u00e9s de un endpoint None/None sin un certificado; con un certificado de aplicaci\u00f3n de cliente de confianza a trav\u00e9s de SignAndEncrypt, puede leer los diagn\u00f3sticos de seguridad de otras sesiones activas, exponiendo nombres de usuario, historial de inicio de sesi\u00f3n, mecanismos de autenticaci\u00f3n, modos y pol\u00edticas de seguridad, y certificados de cliente p\u00fablicos."}], "lastModified": "2026-10-23T23:10:00.157", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:eclipse:milo:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "668DDB9F-3657-40AE-A2FC-0621FF46FA62", "versionEndExcluding": "1.1.5", "versionStartIncluding": "0.6.0"}], "operator": "OR"}]}], "sourceIdentifier": "emo@eclipse.org"}