Cyber ·
Apache PLC4X: OPC UA secure channel flaws allow integrity bypass and unverifiable certificates
Two flaws fixed in PLC4X 1.0.0 affect the OPC UA secure channel. A malicious server, an impersonated server or someone on the network path can exploit them. No fix exists in the 0.13.x series.
On October 30, a researcher published on the oss-sec mailing list details of two vulnerabilities in Apache PLC4X, a client library for communicating with industrial devices. The flaws are tracked as CVE-2026-102508 and CVE-2026-102509. The post describes the mechanisms and trigger conditions of both. According to the notice, CVE-2026-102508 affects versions 0.9.0 to 0.13.1 and involves two defects in the OPC UA asymmetric receive path, present in versions 0.12.0 to 0.13.1. Both flaws were fixed in version 1.0.0. No fix exists for the 0.13.x series. Because PLC4X is a client library, the attacker may be a malicious server or one impersonating a server, or someone positioned on the network path. The described effects include bypassing integrity checks, accepting a certificate that cannot be verified, and silently downgrading the connection. The text available is an automatic translation and the excerpt does not include every technical detail. To confirm scope, conditions and recommendations, consult the original notice in the 2026 oss-sec archive, thread 454 of the fourth quarter, and the corresponding CVE entries.