CVE-2026-58080
Received Received - Intake

Eclipse Milo RoleMapper Bypass via copy() Method

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: Eclipse Foundation

Description
In Eclipse Milo versions 1.0.0 through 1.1.4, `OpcUaServerConfig.copy()` fails to preserve a configured `RoleMapper`. On servers that rely on role permissions and construct the running configuration through `copy()`, sessions receive no role IDs and the default access controller skips role-permission checks, allowing an anonymous client where anonymous sessions are permitted to read role-permission metadata, invoke protected methods, or delete protected nodes.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-04
Last Modified
2026-08-04
Generated
2026-08-04
AI Q&A
2026-08-04
EPSS Evaluated
N/A
NVD
CVE-2026-58080
EUVD
EUVD-2026-52663

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
eclipse milo From 1.0.0 (inc) to 1.1.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

In Eclipse Milo versions 1.0.0 through 1.1.4, the OpcUaServerConfig.copy() method fails to preserve a configured RoleMapper. This causes sessions to receive no role IDs, skipping role-permission checks by the default access controller. As a result, anonymous clients (where allowed) can read role-permission metadata, invoke protected methods, or delete protected nodes.

Detection Guidance

Check if your Eclipse Milo server uses versions 1.0.0 through 1.1.4. Inspect server logs for sessions without role IDs or failed role-permission checks. Verify if copied configurations retain role mappings by reviewing OpcUaServerConfig.copy() behavior.

Impact Analysis

If you use Eclipse Milo servers relying on role permissions and construct configurations via copy(), unauthorized users may gain access to sensitive data or perform restricted actions. This includes reading metadata, invoking protected methods, or deleting nodes, even with anonymous sessions where permitted.

Mitigation Strategies

Upgrade to a patched version of Eclipse Milo where OpcUaServerConfig.copy() preserves RoleMapper. Avoid constructing server configurations via copy() if possible. Review and adjust access controls to restrict anonymous sessions until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-58080. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart