{
  "document": {
    "category": "opc_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "The information provided in this disclosure is provided 'as is' without warranty of any kind. OPC Foundation disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall OPC Foundation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if OPC Foundation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply"
      }
    ],
    "publisher": {
      "category": "vendor",
      "name": "OPC Foundation",
      "namespace": "https://opcfoundation.org/security/csaf"
    },
    "references": [
      {
        "category": "self",
        "summary": "Advisory Source",
        "url": "https://github.com/OPCFoundation/SecurityAdvisories/tree/latest/csaf/2026/001"
      },
      {
        "category": "external",
        "summary": "Mantis Issue",
        "url": "https://mantis.opcfoundation.org/view.php?id=9351"
      },
      {
        "category": "external",
        "summary": "A Comprehensive Formal Security Analysis of OPC UA",
        "url": "https://eprint.iacr.org/2025/148"
      }
    ],
    "title": "Informational Advisory for the OPC UA Specification",
    "tracking": {
      "current_release_date": "2026-08-12T00:00:00Z",
      "id": "OPC-2026-08-12-001",
      "initial_release_date": "2026-08-12T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-08-12T00:00:00Z",
          "number": "1.0.0",
          "summary": "Advisory created."
        }
      ],
      "status": "release",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "category": "product_name",
        "name": "OPC UA Specification Part 2 - Security",
        "product": {
          "name": "OPC UA Specification Part 2 - Security",
          "product_id": "CSAFPID-02",
          "product_identification_helper": {
            "skus": [
              "OPC 10000-2"
            ]
          }
        }
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Vincent Diemunsch"
          ],
          "organization": "ANSSI & Inria, France"
        },
        {
          "names": [
            "Lucca Hirschi"
          ],
          "organization": "Inria, France"
        },
        {
          "names": [
            "Steve Kremer"
          ],
          "organization": "Inria, France",
          "summary": "For discovering the issue using the ProVerif protocol analyzer, see eprint https://eprint.iacr.org/2025/148."
        }
      ],
      "cwe": {
        "id": "CWE-270",
        "name": "Privilege Context Switching Error"
      },
      "discovery_date": "2023-10-10T00:00:00Z",
      "ids": [
        {
          "system_name": "GCVE",
          "text": "GCVE-105-2026-001"
        }
      ],
      "involvements": [
        {
          "date": "2026-08-12T00:00:00Z",
          "party": "vendor",
          "status": "completed"
        }
      ],
      "notes": [
        {
          "category": "other",
          "text": "This item is published for the record as an informational advisory. No CVSS score and no vulnerability severity are assigned. The issue was reported by security researchers, however, the working group concluded that fix cannot be implemented as a general normative requirement because the correct behaviour depends on the Server and on the specific operation and the requirements for different operations can be mutually exclusive. The specification has been updated to add non-normative design guidance reproduced below.",
          "title": "Disposition: Informational"
        }
      ],
      "references": [
        {
          "summary": "CWE-270: Privilege Context Switching Error",
          "url": "https://cwe.mitre.org/data/definitions/270.html"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "OPC UA Part 2 - Security 6.20 (non-normative design guidance): Developers should consider the effect of user context changes. In some cases, a change from low privilege user to a high privilege user could allow a destructive action initiated by the low privilege user to execute under the high privilege user's context. In other cases, the data accessible to a high privilege user could be returned after the low privilege user has taken over. Developers need to consider the risk to the system to determine the best course of action for each operation. Servers may choose to implement a minimum privilege check. i.e. a request that was sent under one user context but processed under another user context will only allow the operation if it is allowed by both user contexts.",
          "product_ids": [
            "CSAFPID-02"
          ],
          "url": "https://reference.opcfoundation.org/Core/Part2/v105/docs/6.20"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Access to data and operations that should be restricted to the new user context."
        }
      ],
      "title": "User context may not propagate to in-flight requests when session credentials change."
    }
  ]
}