CVE-2026-60007 is a high severity padding oracle in Eclipse Milo, the Java OPC UA SDK. Username-token processing returns distinguishable errors for bad RSA padding, so an on-path attacker can recover a captured password. Versions 0.6.0 through 1.1.4 are affected. Upgrade past 1.1.4.
What's affected
- Product: Eclipse Milo, versions 0.6.0 through 1.1.4.
- Fixed: a release after 1.1.4. Confirm the exact version in the Milo release notes, because the record does not name it.
- Exposed: servers that accept username tokens protected with the Basic128Rsa15 security policy.
- Attacker position: on the network path, able to capture a victim's encrypted username token.
How to check if you're exposed
Find the Milo version your build resolves.
mvn dependency:tree -Dincludes=org.eclipse.milo
./gradlew dependencies --configuration runtimeClasspath | grep -i milo
Compare it with the affected range above, and look at transitive use as well: Milo is often embedded in industrial gateways and data collection products that do not list it prominently.
Then check your endpoints. Look at which security policies the server offers, and whether Basic128Rsa15 is enabled. OPC UA endpoint descriptions list the policies, and most OPC UA client tools can show them. Servers that offer only newer policies are not exposed to this attack path.
What to do now
- Upgrade Eclipse Milo to a release after 1.1.4.
- Disable the Basic128Rsa15 security policy on servers and clients that can use something stronger.
- Rotate passwords for accounts that authenticated over Basic128Rsa15 on a network where capture was possible.
- Segment OPC UA traffic so that untrusted hosts cannot sit on the path.
- Run the free in-browser dependency scan on your lockfile or manifest to see every affected package in one pass.
Why it matters
The weakness is CWE-204 (Observable Response Discrepancy). The fix commit is titled as closing the username token padding oracle, and says it normalizes padding and credential failures to the same external status. Before, a decryption failure and a wrong password produced different errors, so each answer leaked information about the plaintext.
An on-path attacker who has captured an encrypted token can send repeated unauthenticated ActivateSession requests and learn the password one answer at a time, then log in with it. The record scores it 7.4 (High), with high attack complexity. The Eclipse CVE assignment request scores it 9.1 (Critical) under CVSS 4.0, so the sources disagree on severity. The record does not mark it as exploited in the wild.
Quick check
Why does the error message matter?
Because a padding oracle turns each different error into a yes or no answer about the decrypted data. Returning the same status for every failure removes that signal.
Sources
Last reviewed: 18 October 2026.
