CVE-2026-95860

Deferred Deferred - Pending Action

Namespace Default Role Permissions Bypass in node-opcua

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: GitHub, Inc.

Description

node-opcua is an OPC UA implementation for TypeScript and Node.js. From 2.42.0 until 2.180.0, namespace-level access control configured through setDefaultRolePermissions is not honored by the runtime enforcement path for nodes without explicit per-node RolePermissions. SessionContext.getApplicableRolePermissions reads a missing or null DefaultRolePermissions metadata value instead of the configured namespace field, and the null result is treated permissively. An anonymous network client can consequently write variables with CurrentWrite access or call bound methods when an operator configured a restrictive namespace default and relied on inheritance. Servers with no declared policy, nodes with explicit per-node permissions, and correctly bound programmatic namespace metadata are outside the authorization-bypass case. This issue is fixed in version 2.180.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-03

Last Modified

2026-11-03

Generated

2026-11-04

AI Q&A

2026-11-04

EPSS Evaluated

N/A

NVD

CVE-2026-95860

EUVD

EUVD-2026-116210

Affected Vendors & Products

Vendor	Product	Version / Range
node-opcua	node-opcua	>= 2.42.0, < 2.180.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-1188	The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.
CWE-636	When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions.
CWE-285	The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability affects node-opcua versions 2.42.0 to 2.180.0. It involves improper enforcement of namespace-level access control. When setDefaultRolePermissions is configured, the runtime fails to honor it for nodes without explicit per-node RolePermissions. The system incorrectly reads a missing or null DefaultRolePermissions value, treating it permissively. This allows anonymous clients to write variables or call methods even when restrictive permissions were set.

Impact Analysis

If you use node-opcua in versions 2.42.0 to 2.180.0, an attacker could exploit this to gain unauthorized write access to variables or execute methods without proper permissions. This could lead to data tampering, unauthorized changes, or system manipulation. Servers with no policies or explicit per-node permissions are not affected.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating confidentiality and integrity requirements in GDPR and HIPAA. Non-compliance may result in legal penalties, data breach notifications, and reputational damage. Organizations must ensure proper access controls to meet regulatory standards.

Mitigation Strategies

Upgrade node-opcua to version 2.180.0 or later to address the namespace-level access control bypass. Verify that DefaultRolePermissions are correctly configured and enforced for all relevant nodes.

Hi! I’m here to help you understand CVE-2026-95860. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...