CVE-2026-67870

Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days.

In open62541 v1.5.5, the server-side AddReferences implementation contains an incomplete validation flaw for non-local ExpandedNodeId targets. A remote attacker can send a crafted AddReferencesRequest with an empty targetServerUri and a non-zero targetNodeId.serverIndex, causing the target node pointer to remain NULL while execution continues.

Published 2026-08-06. Last modified 2026-08-31.