Apache PLC4X OPC UA: signature-verification bypass and silent downgrade enable MITM credential theft (CVE-2026-102508)
Severity: critical · Patch status: patched · Since 2026-10-30 · CVE-2026-102508, CVE-2026-102509, CVE-2026-102510
A researcher disclosed two OPC UA client vulnerabilities in Apache PLC4X, fixed in 1.0.0 with no fixed 0.13.x release. CVE-2026-102508 (0.9.0–0.13.1) combines an inverted signature-verify check and a post-decryption length mismatch in the asymmetric receive path with a permissive default certificate verifier and security-policy downgrade, letting a malicious or on-path server impersonate a legitimate OPC UA server, capture the client nonce and encrypted password, and read/forge MACed session traffic — demonstrated by capturing test credentials and changing a write value undetected. CVE-2026-102509 (0.10.0–0.13.1) covers three pre-auth denial-of-service defects: oversized PascalByteString allocations, unbounded array counts, and unchecked chunk accumulation, causing OutOfMemoryError on client threads. Fixes landed in commits through July 2026; users must upgrade to 1.0.0.
What to do
- Upgrade to Apache PLC4X 1.0.0 immediately; no 0.13.x release contains the fixes
- If upgrade is delayed, configure an explicit trust-store-file for the OPC UA driver so certificate verification fails closed
- Set security-policy explicitly to the strongest required policy and disable discovery=true against untrusted networks
- Restrict network paths between PLC4X clients and OPC UA servers; treat on-path attackers as able to bypass channel integrity on affected versions
- Monitor for OutOfMemoryError on Netty threads as a sign of CVE-2026-102509 DoS attempts
Fixed versions
Sources
All live incidents on Threat Watch
