CVE-2026-63248: Eclipse Milo Information Disclosure Flaw
SentinelOne technical analysis of CVE-2026-63248, a missing authorization vulnerability (CWE-862) in Eclipse Milo OPC UA SDK versions 0.6.0 through 1.1.4. The server fails to enforce access authorization on session security diagnostic nodes: an anonymous client can connect over None/None security policy and enable server diagnostics, then any client with a trusted application certificate over SignAndEncrypt can read SessionSecurityDiagnostics for every active session, exposing usernames, login history, authentication mechanisms, security modes and policies, and public client certificates (passwords and private keys are not exposed per the original vulnerability report). The root cause is that OpcUaServerConfig lacked an access-mode control for SessionSecurityDiagnostics. The fix introduces SessionSecurityDiagnosticsAccessMode (default RESTRICTED) in commit a5dae1b. The article includes detection methods, IoCs, and mitigation steps. Corroborated by the Eclipse GitLab vulnerability report #598 and the GitHub patch commit.
Research notes
- Root causeMissing authorization on session security diagnostic nodes: OpcUaServerConfig class lacked an access-mode control for SessionSecurityDiagnostics, so read access was governed only by transport-level checks rather than a per-session authorization decision.
- Technical detailTwo-step attack: an anonymous client connects over None/None security policy to enable server diagnostics, then any client with a trusted application certificate over SignAndEncrypt can browse and read SessionSecurityDiagnostics for every active session, exposing usernames, login history, authentication mechanisms, security modes and policies, and public client certificates. Passwords and private keys are not exposed.
- Technical detailThe fix introduces a SessionSecurityDiagnosticsAccessMode configuration setting (default RESTRICTED) that restricts which sessions can observe security diagnostics for others, implemented in commit a5dae1b.