CVE-2026-21018 – OPC UA Authentication Bypass via None Security Policy

Program Code (Python opcua-asyncio sim)

# opcua_server_sim.py - OPC UA server accepting None security policy
from asyncua import Server
import asyncio

async def main():
    server = Server()
    await server.init()
    server.set_endpoint('opc.tcp://0.0.0.0:4840/freeopcua/server/')
    server.set_security_policy([ua.SecurityPolicyType.NoSecurity])  # Allows unencrypted, unauthenticated
    async with server:
        while True:
            await asyncio.sleep(1)

asyncio.run(main())

CVE-2026-21018 – OPC UA Authentication Bypass via None Security Policy

Overview

An OPC UA server is configured with the None security policy, which provides no encryption or authentication. An attacker on the network can connect and interact with industrial control system tags, causing physical damage.

Vulnerability Details

• Type: Missing Authentication
• Impact: Unauthorized control of industrial processes.
• Root Cause: The server endpoint allows unsecured connections, enabling any client to read and write variables.

Exploit Demonstration

1. Start the simulated server:
   root@kitploit:~

   pip install asyncua
   python opcua_server_sim.py
   
   

2. Run the exploit:
   root@kitploit:~

   python exploit_opcua_none.py
   

The client connects successfully.