CVE-2026-60007 Information disclosure in Eclipse Milo

Critical 9.1 Published 4 Aug 2026 Updated 4 Aug 2026

An on-path attacker can recover victim passwords via a padding oracle in Eclipse Milo, enabling unauthorized authentication and data access.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-60007?

CVE-2026-60007 is a critical vulnerability in Eclipse Milo, published on 4 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding and other authentication failures, allowing an on-path attacker who captures a victim's `Basic128Rsa15`-encrypted username token to use repeated unauthenticated `ActivateSession` requests as a padding oracle, recover the victim's password, and authenticate with the recovered credentials.

Weakness: CWE-204

Which versions are affected by CVE-2026-60007?

It affects 1 product.

Products include Eclipse Milo.

How do I fix CVE-2026-60007?

No fix has been published for CVE-2026-60007 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-60007 being exploited?

There is no known exploitation of CVE-2026-60007 in the wild and no public exploit code.

Sources

Also known as GHSA-jrjq-9cmf-3h6f.