# CVE-2023-26150: asyncua improper authentication in Address Space access

Source: https://junglewise.ai/threats/cve-2023-26150-asyncua-improper-authentication-in-address-space-access  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-10-03. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2023-26150 · Severity: low · CVSS 3.1 · Published 2023-10-03

asyncua is a Python library implementing the OPC UA (Open Platform Communications) protocol, which is widely used for secure data exchange in industrial automation and control systems. A vulnerability allows unauthorized access to the Address Space (the data exposed by an OPC UA server) without proper encryption or authentication. An attacker can read and modify sensitive industrial data or device settings by connecting to the server and bypassing required security checks.

Technologies: [asyncua (PyPI)](https://junglewise.ai/threats/technologies/asyncua). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2023-26150 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-26150 being exploited in the wild.

**How severe is CVE-2023-26150?** Low severity, with a CVSS score of 3.1, published 3 October 2023.

**Which products and versions are affected?** asyncua (PyPI) ECOSYSTEM:introduced=0,fixed=0.9.96, GIT:introduced=0,fixed=b4106dfd5037423c9d1810b48a97296b59cde513,fixed=2be7ce80df05de8d6c6ae1ebce6fa2bb7147844a|ECOSYSTEM:introduced=0,fixed=0.9.96.

**Is there a fix for CVE-2023-26150?** Yes. asyncua (PyPI): upgrade to 0.9.96 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2023-26150 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2023-26150?** Check whether you run asyncua (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- asyncua (PyPI): upgrade to 0.9.96 or later

  ```sh
  pip install "asyncua>=0.9.96"
  ```


## Technical details

The vulnerability is an improper authentication issue (CWE-287) in asyncua versions prior to 0.9.96. The root cause is missing validation checks for services that require an active authenticated session. An attacker can establish a secure channel with "security none" and create a session without proper authentication, then issue Read and Write requests to access or modify nodes in the Address Space. The attack requires network access to the OPC UA server but no authentication credentials. The fix was applied in version 0.9.96 and later versions.

## Affected products

- FreeOpcUa asyncua before 0.9.96

## Identifiers

- CVE-2023-26150
- GHSA-2894-qcqf-g23g
- PYSEC-2023-189

## Timeline

- 2022-08-29: disclosed
- 2023-10-03: advisory
- 2023-10-03: patched: version 0.9.96 released

## References

- [https://github.com/FreeOpcUa/opcua-asyncio/issues/1014](https://github.com/FreeOpcUa/opcua-asyncio/issues/1014)

## Related threats

- [PYSEC-2026-888 - Uncontrolled Resource Consumption in asyncua and opcua](https://junglewise.ai/threats/cve-2022-25304-uncontrolled-resource-consumption-in-asyncua-and-opcua)
- [asyncua vulnerable to denial of service via infinite loop](https://junglewise.ai/threats/cve-2023-26151-asyncua-vulnerable-to-denial-of-service-via-infinite-loop)