CVE-2026-63248

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-63248
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63248.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-63248
Published
2026-08-04T12:07:43.820Z
Modified
2026-08-07T08:11:21.665632Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
[none]
Details

In Eclipse Milo versions 0.6.0 through 1.1.4, OPC UA server diagnostics nodes do not enforce access authorization. An anonymous client can enable diagnostics over a None/None endpoint without a certificate; with a trusted client application certificate over SignAndEncrypt, it can read security diagnostics for other active sessions, exposing usernames, login history, authentication mechanisms, security modes and policies, and public client certificates.

Database specific 
{
    "cna_assigner": "eclipse",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63248.json",
    "cwe_ids": [
        "CWE-862"
    ]
}
References

Affected packages

Git / github.com/eclipse-milo/milo

Affected ranges

Type
GIT
Repo
https://github.com/eclipse-milo/milo
Events
Introduced
9fd8a23ae26263ccd8045d02eae0f9466d06207b
Fixed
8e84cd7d0d8e6eb787f89c5c1319b885d666fe4b
Fixed
a5dae1be0657d2b4fcb66e63f377c1dc36069e2a
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0.6.0"
        },
        {
            "fixed": "1.1.5"
        }
    ],
    "cpe": "cpe:2.3:a:eclipse:milo:*:*:*:*:*:*:*:*",
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Database specific

vanir_signatures 
[
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "length": 825.0,
            "function_hash": "69440064539507904733303993804962588912"
        },
        "id": "CVE-2026-63248-058aca87",
        "signature_type": "Function",
        "source": "https://github.com/eclipse-milo/milo/commit/a5dae1be0657d2b4fcb66e63f377c1dc36069e2a",
        "target": {
            "function": "createSessionDiagnosticsObject",
            "file": "opc-ua-sdk/sdk-server/src/main/java/org/eclipse/milo/opcua/sdk/server/diagnostics/objects/SessionsDiagnosticsSummaryObject.java"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "303441870997217127472596213842669066892",
                "116527255512152399394208177748550559263",
                "7047468021265909414846023400596150853",
                "226260439260385059513475804070027919853",
                "253555665007905669505827060013496701426",
                "195914410378010686252443664909598372343",
                "134074038160651699783038394201215546799",
                "53232770557950312295165936370715626848",
                "228127598312894174300808112700880953181",
                "321486324625229041482967725148666997359",
                "18632656768238008567945768506712865481",
                "227218303714676082919872483478871359641",
                "246118888343559025988319060823040155361",
                "195904055048410532182730488527054834561",
                "216383506695233791055169726412457571916",
                "187981381728936515874482380998680266462",
                "124405387241754742249530553839247152415",
                "102331813929212799532112282506321089151",
                "48278627608703117509272168453812672193",
                "10141581490641855810287850185379299333",
                "178983251014978477610641115488063400004",
                "139007478323202232003993797933228415082",
                "201688184766555145675407340574044270129",
                "157854253174592076742155955410192970077",
                "109428439936513610724275661792832500832",
                "76970542485933506784057473603019183905",
                "250052232031290205954373542202099845666",
                "214301087569152577647189957842463772186",
                "319397369313693005137099734676476867485",
                "47389971728051917132931471303659369979",
                "230648043656955642612893490131434842243",
                "186377252821541556889837555235743558414",
                "117188131978029949975275709963945825526",
                "213033461096647461767154707226874671155",
                "39911575108909401105692502950095387321",
                "24000426844496274834962830296371760099",
                "285837956610833031019031113737283960695",
                "275855332820540879119311729191070894257",
                "47672601458951374217731788505091433952",
                "261935170672407105939781771670801518539",
                "154450666558450781051447432408372324774",
                "230744596150485232415769936064815627915"
            ]
        },
        "id": "CVE-2026-63248-232a3780",
        "signature_type": "Line",
        "source": "https://github.com/eclipse-milo/milo/commit/a5dae1be0657d2b4fcb66e63f377c1dc36069e2a",
        "target": {
            "file": "opc-ua-sdk/sdk-server/src/main/java/org/eclipse/milo/opcua/sdk/server/diagnostics/variables/SessionSecurityDiagnosticsVariableArray.java"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "277166492261695865707637869681959473585",
                "127598466147564799648152350501541480222",
                "172576090934465264929594914414323708894",
                "255224045132928819059662012372598479239",
                "50986911793598949260120588700558499601",
                "268323273840309741210390709701922945764",
                "161829798240473966503976043700377912738",
                "331571577298615397943694118100801633545",
                "40857030991089384433245872149260071612",
                "94686720041189945138925932983806598206",
                "250265354043406593855057750479641893022",
                "333218295699123462157351062805738181606",
                "228279542180918705211904474192653418987",
                "12922198462354628135885025170304127560",
                "93428214701263678692162339818717021277",
                "333049099436609079469191650775500307337",
                "90594848218691803029048667752784979994",
                "183454879602898143211790384668106133617",
                "287143917187897623665803313002779060743",
                "69053461917378516654828095577906686643",
                "244125084856819352952595829882912148068"
            ]
        },
        "id": "CVE-2026-63248-23bb3c22",
        "signature_type": "Line",
        "source": "https://github.com/eclipse-milo/milo/commit/a5dae1be0657d2b4fcb66e63f377c1dc36069e2a",
        "target": {
            "file": "opc-ua-sdk/sdk-server/src/main/java/org/eclipse/milo/opcua/sdk/server/diagnostics/variables/Util.java"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "180902658367421844145670831015508759741",
                "68954397994322904886018107634503986732",
                "75111379373401605264581032097078734688",
                "7617480951523334601411634232397844436",
                "75279172420732993307609348514208999317",
                "176497648805929882632352948894906768997",
                "87317233150395088440927934864230675712",
                "173054694076154706391201602606895775638",
                "337821560929549781028058291207812735610",
                "3984253908807528697066925857918199208",
                "123831349978657576361064728198995151820"
            ]
        },
        "id": "CVE-2026-63248-31fd0a2d",
        "signature_type": "Line",
        "source": "https://github.com/eclipse-milo/milo/commit/a5dae1be0657d2b4fcb66e63f377c1dc36069e2a",
        "target": {
            "file": "opc-ua-sdk/sdk-server/src/main/java/org/eclipse/milo/opcua/sdk/server/OpcUaServerConfig.java"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "length": 2636.0,
            "function_hash": "208378725924798732191170601537836686904"
        },
        "id": "CVE-2026-63248-3a77410e",
        "signature_type": "Function",
        "source": "https://github.com/eclipse-milo/milo/commit/a5dae1be0657d2b4fcb66e63f377c1dc36069e2a",
        "target": {
            "function": "onStartup",
            "file": "opc-ua-sdk/sdk-server/src/main/java/org/eclipse/milo/opcua/sdk/server/diagnostics/variables/SessionSecurityDiagnosticsVariable.java"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "length": 506.0,
            "function_hash": "19699944511393997623460495295489557888"
        },
        "id": "CVE-2026-63248-4cf36a13",
        "signature_type": "Function",
        "source": "https://github.com/eclipse-milo/milo/commit/a5dae1be0657d2b4fcb66e63f377c1dc36069e2a",
        "target": {
            "function": "OpcUaServerConfigImpl",
            "file": "opc-ua-sdk/sdk-server/src/main/java/org/eclipse/milo/opcua/sdk/server/OpcUaServerConfigBuilder.java"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "283907241502932661123908665155503458612",
                "96867005693703802865469792624680849725",
                "170861824621939622412723857250779894449",
                "73526134531899174431219921722056642411",
                "271968030684373472076934103509646646706",
                "332067341167422687819023764048350415457",
                "282224209796475407186260909214865666910",
                "246845722571077992259799370903613658838",
                "334034527097718740744647880009312320802",
                "259227601806162549118951980121624747026",
                "98162766496521979621759306292847591331",
                "201453541619937231645429868834111794226",
                "324329336747086200088956528940080980001",
                "45032201319936612631920932788853173916",
                "68022661720267457038906881261917800243",
                "336336085350573442963733034953648320268",
                "12365643393726452297808704805815501966",
                "65250732771080484001402856150008061459",
                "147884419209425903217188210310531385089",
                "78796026759443015057595780490458394195",
                "227408301886766357717036712897260234401",
                "203319846617983250058652474364269238911",
                "51182137246561157810367758488386440362",
                "216278831306712561635021924592653360289",
                "157578671356525678484134810835739330021",
                "324390525122737803309761230808379404811",
                "258757638277279690777220329634039464668",
                "219061435539807847765294255374465375865",
                "198947632410846834395870691944181966119",
                "183870718653981964123485608437872372933"
            ]
        },
        "id": "CVE-2026-63248-605fb0d8",
        "signature_type": "Line",
        "source": "https://github.com/eclipse-milo/milo/commit/a5dae1be0657d2b4fcb66e63f377c1dc36069e2a",
        "target": {
            "file": "opc-ua-sdk/sdk-server/src/main/java/org/eclipse/milo/opcua/sdk/server/OpcUaServerConfigBuilder.java"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "length": 592.0,
            "function_hash": "30723857148172134723989380224871929488"
        },
        "id": "CVE-2026-63248-821ba776",
        "signature_type": "Function",
        "source": "https://github.com/eclipse-milo/milo/commit/a5dae1be0657d2b4fcb66e63f377c1dc36069e2a",
        "target": {
            "function": "onShutdown",
            "file": "opc-ua-sdk/sdk-server/src/main/java/org/eclipse/milo/opcua/sdk/server/diagnostics/variables/SessionSecurityDiagnosticsVariableArray.java"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "171369460797754139252739958837905036639",
                "50846362223848616508348655067690367700",
                "144852260301288398615549584215948465536",
                "14718297501189087966995631977743846168",
                "197010331885605699935443073762777090171",
                "166495948042349055671147431997144650424",
                "24927860064910058847323341491332960858",
                "214207731212868880920748726590035119551",
                "203350155688728407019717872782225995635",
                "256217838780698992628537490212731615326",
                "65054601052637700288767389906385434506",
                "203658118051477390330966299964225093651",
                "290946434921367188058802914887721080229"
            ]
        },
        "id": "CVE-2026-63248-92b95c2a",
        "signature_type": "Line",
        "source": "https://github.com/eclipse-milo/milo/commit/a5dae1be0657d2b4fcb66e63f377c1dc36069e2a",
        "target": {
            "file": "opc-ua-sdk/sdk-server/src/main/java/org/eclipse/milo/opcua/sdk/server/diagnostics/variables/SessionSecurityDiagnosticsVariable.java"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "length": 1452.0,
            "function_hash": "198685823552105637882948015987335981846"
        },
        "id": "CVE-2026-63248-9635fc3e",
        "signature_type": "Function",
        "source": "https://github.com/eclipse-milo/milo/commit/a5dae1be0657d2b4fcb66e63f377c1dc36069e2a",
        "target": {
            "function": "onStartup",
            "file": "opc-ua-sdk/sdk-server/src/main/java/org/eclipse/milo/opcua/sdk/server/diagnostics/variables/SessionSecurityDiagnosticsVariableArray.java"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "length": 1229.0,
            "function_hash": "243081033112969768629389231748808210701"
        },
        "id": "CVE-2026-63248-993f3658",
        "signature_type": "Function",
        "source": "https://github.com/eclipse-milo/milo/commit/a5dae1be0657d2b4fcb66e63f377c1dc36069e2a",
        "target": {
            "function": "createSessionSecurityDiagnosticsVariable",
            "file": "opc-ua-sdk/sdk-server/src/main/java/org/eclipse/milo/opcua/sdk/server/diagnostics/variables/SessionSecurityDiagnosticsVariableArray.java"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "length": 394.0,
            "function_hash": "334593568978264985865505539015604435793"
        },
        "id": "CVE-2026-63248-99b39685",
        "signature_type": "Function",
        "source": "https://github.com/eclipse-milo/milo/commit/a5dae1be0657d2b4fcb66e63f377c1dc36069e2a",
        "target": {
            "function": "build",
            "file": "opc-ua-sdk/sdk-server/src/main/java/org/eclipse/milo/opcua/sdk/server/OpcUaServerConfigBuilder.java"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "216280878946446593489431789406750446448",
                "50890724379046215129563095305327348140",
                "156810830936906584836143790935084473610",
                "298745105078024480065691748159034349424",
                "25599148989635299157516635405629685942",
                "290986909573655747310762652573781141883",
                "262301104937021964266155830218479666457"
            ]
        },
        "id": "CVE-2026-63248-bb796659",
        "signature_type": "Line",
        "source": "https://github.com/eclipse-milo/milo/commit/a5dae1be0657d2b4fcb66e63f377c1dc36069e2a",
        "target": {
            "file": "opc-ua-sdk/sdk-server/src/test/java/org/eclipse/milo/opcua/sdk/server/diagnostics/objects/SessionsDiagnosticsSummaryObjectTest.java"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "225556730945068818697399985758819041460",
                "267575007327886443972947919146796760970",
                "160802657464911801750351567127771695161",
                "302725417824623957033464474648680423089",
                "261092362970506000703748977332626591195",
                "99233781890356087460162762091646914548",
                "64141079737528197923833962715740385243",
                "126810267553187111130049701883984443159",
                "166582373143500872275856475992132940980",
                "289230073625822065542349062034213867566",
                "263517406995432757745180082737800613332",
                "314461796876257498554314723265353441937",
                "249999864022963580814252636005101655048",
                "52318700439709420609541125825280786949",
                "78625876816567422305803062698120534398",
                "72938717232436495135485037376233445269",
                "230566769737222825637973543962850179043",
                "104063110637188641801120474194462863755",
                "183257088606475610287723768107501735313",
                "80912662017180960203643951009294437921",
                "130925421223878387542317551456130829991"
            ]
        },
        "id": "CVE-2026-63248-d9cb3e30",
        "signature_type": "Line",
        "source": "https://github.com/eclipse-milo/milo/commit/a5dae1be0657d2b4fcb66e63f377c1dc36069e2a",
        "target": {
            "file": "opc-ua-sdk/sdk-server/src/main/java/org/eclipse/milo/opcua/sdk/server/diagnostics/objects/SessionsDiagnosticsSummaryObject.java"
        }
    }
]
vanir_signatures_modified 
"2026-08-07T08:11:21Z"
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63248.json"