{"id":"CVE-2026-67870","aliases":["DEBIAN-CVE-2026-67870","EUVD-2026-53681","GHSA-3jmw-8hr3-2j76","UBUNTU-CVE-2026-67870"],"status":"published","title":"In open62541 v1.5.5, the server-side AddReferences implementation contains an incomplete...","description":"In open62541 v1.5.5, the server-side AddReferences implementation contains an incomplete validation flaw for non-local ExpandedNodeId targets. A remote attacker can send a crafted AddReferencesRequest with an empty targetServerUri and a non-zero targetNodeId.serverIndex, causing the target node pointer to remain NULL while execution continues.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.01063,"percentile":0.64931,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-476"],"published":"2026-08-05T00:00:00Z","modified":"2026-10-17T13:00:40Z","affected":[{"source":"osv","ecosystem":"Debian:13","package":"open62541","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.11.1-1","1.4.18-1"]},{"source":"osv","ecosystem":"Debian:14","package":"open62541","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.11.1-1","1.4.18-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"open62541","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.11.1-1build1","1.4.18-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"open62541","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.11.1-1","1.4.11.1-1build1"]}],"references":[{"url":"https://github.com/open62541/open62541/blob/v1.5.5/src/server/ua_services_nodemanagement.c","tags":["report"]},{"url":"https://github.com/open62541/open62541/issues/8172","tags":["exploit","report"]},{"url":"https://github.com/open62541/open62541/blob/v1.5.5/include/open62541/types.h","tags":["report"]},{"url":"https://github.com/open62541/open62541/blob/v1.5.5/src/ua_types.c","tags":["report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67870"},{"url":"https://github.com/advisories/GHSA-3jmw-8hr3-2j76"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-67870","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-67870","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67870","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-67870","description":"In open62541 v1.5.5, the server-side AddReferences implementation contains an incomplete validation flaw for non-local ExpandedNodeId targets. A remote attacker can send a crafted AddReferencesRequest with an empty targetServerUri and a non-zero targetNodeId.serverIndex, causing the target node pointer to remain NULL while execution continues.","status":"published","published":"2026-08-05T00:00:00Z","modified":"2026-08-06T15:54:03.899Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:20:06.562031Z"}],"euvd":[{"id":"EUVD-2026-53681","description":"In open62541 v1.5.5, the server-side AddReferences implementation contains an incomplete validation flaw for non-local ExpandedNodeId targets. A remote attacker can send a crafted AddReferencesRequest with an empty targetServerUri and a non-zero targetNodeId.serverIndex, causing the target node pointer to remain NULL while execution continues.","status":"published","published":"2026-08-05T00:00:00Z","modified":"2026-08-06T15:54:03Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T18:02:08.101336Z"}],"ghsa":[{"id":"GHSA-3jmw-8hr3-2j76","title":"In open62541 v1.5.5, the server-side AddReferences implementation contains an incomplete...","description":"In open62541 v1.5.5, the server-side AddReferences implementation contains an incomplete validation flaw for non-local ExpandedNodeId targets. A remote attacker can send a crafted AddReferencesRequest with an empty targetServerUri and a non-zero targetNodeId.serverIndex, causing the target node pointer to remain NULL while execution continues.","status":"published","published":"2026-08-06T00:31:31Z","modified":"2026-08-07T00:31:09Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T15:10:10.387883Z"}],"nvd":[{"id":"CVE-2026-67870","description":"In open62541 v1.5.5, the server-side AddReferences implementation contains an incomplete validation flaw for non-local ExpandedNodeId targets. A remote attacker can send a crafted AddReferencesRequest with an empty targetServerUri and a non-zero targetNodeId.serverIndex, causing the target node pointer to remain NULL while execution continues.","status":"published","published":"2026-08-06T00:16:54.043Z","modified":"2026-08-31T19:33:11.197Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:12:35.031043Z"}],"osv":[{"id":"DEBIAN-CVE-2026-67870","description":"In open62541 v1.5.5, the server-side AddReferences implementation contains an incomplete validation flaw for non-local ExpandedNodeId targets. A remote attacker can send a crafted AddReferencesRequest with an empty targetServerUri and a non-zero targetNodeId.serverIndex, causing the target node pointer to remain NULL while execution continues.","status":"published","published":"2026-08-06T00:16:54.043Z","modified":"2026-10-01T03:03:48.363146682Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:46:01.68444Z"},{"id":"UBUNTU-CVE-2026-67870","description":"In open62541 v1.5.5, the server-side AddReferences implementation contains an incomplete validation flaw for non-local ExpandedNodeId targets. A remote attacker can send a crafted AddReferencesRequest with an empty targetServerUri and a non-zero targetNodeId.serverIndex, causing the target node pointer to remain NULL while execution continues.","status":"published","published":"2026-08-06T00:16:00Z","modified":"2026-10-17T13:00:40.210734564Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:56:53.710209Z"}]}}