CVE-2026-63248

MEDIUM

In Eclipse Milo versions 0.6.0 through 1.1.4, OPC UA server diagnostics nodes do not enforce access authorization. An anonymous client can enable diagnostics over a None/None endpoint without a certificate; with a trusted client application certificate over SignAndEncrypt, it can read security diagnostics for other active sessions, exposing usernames, login history, authentication mechanisms, security modes and policies, and public client certificates.

CVSS v3.1 Score

6.5
MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE
Published: 8/4/2026Modified: 10/23/2026

Related Intelligence (0)

No articles currently reference this CVE.

References (3)

https://github.com/eclipse-milo/milo/commit/a5dae1be0657d2b4fcb66e63f377c1dc36069e2aPatchhttps://gitlab.eclipse.org/security/cve-assignment/-/work_items/181Issue TrackingPatchhttps://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/598Issue TrackingVendor Advisory