OpenPLC Runtime v3 Gets No Fix for a Session-Hijack Flaw
Security / news
OpenPLC Runtime v3 Gets No Fix for a Session-Hijack Flaw
CVE-2026-88020 lets an attacker hijack an operator's session and issue commands to a programmable logic controller, and Autonomy Logic says the only fix is upgrading to OpenPLC v4.
An attacker who gets an OpenPLC Runtime v3 operator to click a crafted link can hijack that operator's session and issue commands to the programmable logic controller behind it, under a flaw CISA disclosed Sept. 22, 2026, that the project's maintainer says it will not fix.
CISA's advisory names a 6.1 score and two reporters
The advisory, ICSA-26-265-09, assigns CVE-2026-88020 a CVSS 3.1 score of 6.1, medium severity, for a cross-site scripting weakness in how the web interface routes programs based on a query-string parameter it does not encode. CISA credits Rajivarnan R. and Shirshak of the firm Secnora with reporting it. Successful exploitation, the advisory says, "could allow an attacker to hijack session cookies and issue state-changing requests as an operator," which for a PLC means the ability to alter what the physical process it controls actually does.
There is no patch, only a different codebase
OpenPLC Runtime v3 reached end of life and "is no longer maintained," according to a notice at the top of its own GitHub repository, which carries 1,600 stars and 609 forks. Vendor Autonomy Logic's only remediation is a full upgrade to OpenPLC Runtime v4, a separate codebase hosted under a different repository. CISA's interim mitigation is the one it gives for most unpatched ICS bugs: keep the device off the public internet, isolate it behind a firewall, and require a VPN for remote access.
| OpenPLC Runtime | Status | Fix available |
|---|---|---|
| v3 (CVE-2026-88020) | End of life, unmaintained | None; upgrade only |
| v4 | Current, actively maintained | N/A, not affected |
A low-cost controller with a wide footprint
OpenPLC describes itself as a low-cost industrial automation platform meant for both real deployments and cybersecurity research, and CISA's advisory lists Critical Manufacturing, Energy, Transportation Systems and Water and Wastewater Systems as sectors where it is used worldwide. The precondition that limits the flaw's reach is the CVSS vector's UI:R marker: it requires an operator to interact with something an attacker controls, such as a malicious link, rather than working against an idle system on its own. A 6.1 score is not the same as an unreachable one; a phishing email sent to a single plant operator with the CISA advisory's browser open is enough to trigger it, since the query parameter it abuses lives in the same web interface that operator would already be using to route programs to the controller.
CVE-2026-88020's full vector, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, rates both confidentiality and integrity impact low and availability impact none. That distinction matters for triage: the flaw cannot by itself take a controller offline, only leak session data and let an attacker issue whatever state-changing web requests the hijacked operator session is already authorized to make.
OpenPLC's no-patch situation is not unique this month. Hitachi Energy also disclosed a flaw, rated 9.9, with no fixed version yet available, and CISA separately published an authentication-bypass advisory for Siemens Reyrolle relays in the same stretch of September ICS advisories.
CISA's advisory carries no federal patching deadline, unlike the three-day windows it has set this month for flaws confirmed as actively exploited, because OpenPLC Runtime v3 is not known to be exploited yet. For an operator still running it, the only way off the flaw is the v4 migration Autonomy Logic has been recommending since the older runtime's end of life.
Sources
More in Security
- 01CISA Gives Agencies 3 Days to Patch an Exploited SharePoint BugMicrosoft rated the flaw a low-risk spoofing issue for 16 days after patching it, and a honeypot logged the first attack four weeks after the correction upgraded it to an 8.8.
- 02CISA Adds a Fourth MikroTrick Bug to Its Exploited ListCVE-2026-67279 joins two other bugs from the same six-flaw MikroTik batch already on CISA's list, but Bishop Fox says it, not the pair flagged in September, is the one that actually opens the door.
- 03OpenClaw's New Scanners Agree on Just 0.69% of Risky SkillsFour audits since February have counted between 341 and 1,467 malicious or flawed skills on ClawHub, and NVIDIA's scanner disagrees with the other two on all but 468 of 67,453 skills checked.
- 04CISA Lists 14 Botslab Dashcam Flaws With No Fix in SightThe worst of the bugs lets a network attacker push firmware with no cryptographic signature onto the device, and Botslab has not told CISA whether it plans to fix any of the 14.