In Eclipse Milo versions 0.6.0 through 1.1.4, the OPC UA server diagnostics nodes lack proper access authorization enforcement. An anonymous client can enable diagnostics over an unauthenticated None/None endpoint, while a client with a trusted application certificate over SignAndEncrypt can read security diagnostics for other active sessions. This exposure includes usernames, login history, authentication mechanisms, security modes and policies, and public client certificates. The vulnerability is tracked as CVE-2026-63248 and categorized under CWE-862 (Improper Authorization).

The vulnerability allows unauthorized access to sensitive security diagnostics information. An anonymous attacker can enable diagnostics without authentication, and a trusted client can access detailed security information of other sessions. This exposure can lead to information disclosure about usernames, login history, authentication methods, security modes, policies, and public client certificates, potentially aiding further attacks or reconnaissance.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation is currently documented. Users should monitor the vendor's communications for updates and consider restricting access to OPC UA diagnostics nodes until a fix is available.