CVE-2026-95860 with a CVSS score of 9.1 is a critical authorization fail-open vulnerability in the node-opcua OPC UA server stack, specifically in namespace-level role-based access control enforcement. It affects node-opcua (npm) versions >= 2.42.0, < 2.180.0, node-opcua-address-space (npm) versions >= 2.42.0, < 2.180.0, and node-opcua-server (npm) versions >= 2.42.0, < 2.180.0. The flaw occurs when nodes lack explicit per-node RolePermissions and inherit the namespace DefaultRolePermissions, but the runtime resolves that default to null and grants all permissions instead of denying access. An unauthenticated remote attacker with network access to an OPC UA endpoint can create an anonymous session, write protected variables, and call privileged bound methods when the server permits anonymous access and the affected namespace relies on default permissions. This can allow modification of process setpoints, safety parameters, or other controlled values, and execution of methods that affect operations, causing confidentiality and integrity loss and potentially severe business disruption, production downtime, or unsafe industrial conditions.
We recommend you to update node-opcua to version 2.180.0.[/subscribe_to_unlock_form]
CVE-2026-95860 with a CVSS score of 9.1 is a critical authorization fail-open vulnerability in the node-opcua OPC UA server stack, specifically in namespace-level role-based access control enforcement. It affects node-opcua (npm) versions >= 2.42.0, < 2.180.0, node-opcua-address-space (npm) versions >= 2.42.0, < 2.180.0, and node-opcua-server (npm) versions >= 2.42.0, < 2.180.0. The flaw occurs when nodes lack explicit per-node RolePermissions and inherit the namespace DefaultRolePermissions, but the runtime resolves that default to null and grants all permissions instead of denying access. An unauthenticated remote attacker with network access to an OPC UA endpoint can create an anonymous session, write protected variables, and call privileged bound methods when the server permits anonymous access and the affected namespace relies on default permissions. This can allow modification of process setpoints, safety parameters, or other controlled values, and execution of methods that affect operations, causing confidentiality and integrity loss and potentially severe business disruption, production downtime, or unsafe industrial conditions.
We recommend you to update node-opcua to version 2.180.0.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]