CVE-2026-63248

In Eclipse Milo versions 0.6.0 through 1.1.4, OPC UA server diagnostics nodes do not enforce access authorization. An anonymous client can enable diagnostics over a None/None endpoint without a certificate; with a trusted client application certificate over SignAndEncrypt, it can read security diagnostics for other active sessions, exposing usernames, login history, authentication mechanisms, security modes and policies, and public client certificates.

CVSS 4.0

6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS

0.3% chance of exploitation in the next 30 days; higher than 17% of CVEs (scores of 2026-10-25)

CWE

CWE-862

Published

2026-08-04

Modified

2026-10-23

Record from

the NVD, synced 2026-10-24

Affected

• eclipse:milo

References

• https://github.com/eclipse-milo/milo/commit/a5dae1be0657d2b4fcb66e63f377c1dc36069e2a
• https://gitlab.eclipse.org/security/cve-assignment/-/work_items/181
• https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/598

Check your stackJSON