CVE-2026-63248

MediumCVSS 6.5/10Last modified Oct 23, 2026

Description

In Eclipse Milo versions 0.6.0 through 1.1.4, OPC UA server diagnostics nodes do not enforce access authorization. An anonymous client can enable diagnostics over a None/None endpoint without a certificate; with a trusted client application certificate over SignAndEncrypt, it can read security diagnostics for other active sessions, exposing usernames, login history, authentication mechanisms, security modes and policies, and public client certificates.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
Eclipse Foundation	Eclipse Milo	>= 0.6.0, <= 1.1.4

References

https://github.com/eclipse-milo/milo/commit/a5dae1be0657d2b4fcb66e63f377c1dc36069e2aPatch
https://gitlab.eclipse.org/security/cve-assignment/-/work_items/181Issue Tracking, Patch, Vendor Advisory
https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/598Issue Tracking, Vendor Advisory

Timeline

Published: Aug 4, 2026
Last modified: Oct 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-63257.5Out-of-bounds write in SetSuitesHashSigAlgo when processing an oversized signature algorithms list, allowing a write past the bounds of the CVE-2026-632527.5In Eclipse Milo versions 0.6.0 through 1.1.4, UASC server transport handlers fail to release retained partial message chunks when a channel CVE-2026-632594.3Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via user-supplied identifiers that r CVE-2026-632606.5Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated a CVE-2026-632616.5Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged a CVE-2026-632624.3Missing Authorization (CWE-862) in Kibana can lead to unauthorized cross-space information disclosure via user-supplied input that circumven CVE-2026-632636.5Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Exponential Data Expansion (CAPEC-197). An au CVE-2026-632645.3Joomla Extension - joomshopping.com - Reflective XSS in JoomShopping < 5.9.3 - The Joomla extension JoomShopping is vulnerable to an reflect CVE-2026-632658.0Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various Regular Labs extension AJAX endpoints - Pr CVE-2026-632666.8LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. Through such a link a document cou CVE-2026-632676.7LibreOffice Calc can link a cell range to an external csv data source, and the link is saved in the document. Such a link was fetched while CVE-2026-632686.7LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A link of the sql type could name