CVE-2026-95860

Full vulnerability record from the local CVENow database.

Description

node-opcua is an OPC UA implementation for TypeScript and Node.js. From 2.42.0 until 2.180.0, namespace-level access control configured through setDefaultRolePermissions is not honored by the runtime enforcement path for nodes without explicit per-node RolePermissions. SessionContext.getApplicableRolePermissions reads a missing or null DefaultRolePermissions metadata value instead of the configured namespace field, and the null result is treated permissively. An anonymous network client can consequently write variables with CurrentWrite access or call bound methods when an operator configured a restrictive namespace default and relied on inheritance. Servers with no declared policy, nodes with explicit per-node permissions, and correctly bound programmatic namespace metadata are outside the authorization-bypass case. This issue is fixed in version 2.180.0.

Severity

CRITICAL

CVSS score

9.1 (v3.1)

Vulnerability status

Deferred

Source identifier

[email protected]

Published

2026-11-03 21:17:45.907000

Last modified

2026-11-03 21:17:46.053000

View original CVE JSON

{
  "id": "CVE-2026-95860",
  "sourceIdentifier": "[email protected]",
  "published": "2026-11-03T21:17:45.907",
  "lastModified": "2026-11-03T21:17:46.053",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "node-opcua is an OPC UA implementation for TypeScript and Node.js. From 2.42.0 until 2.180.0, namespace-level access control configured through setDefaultRolePermissions is not honored by the runtime enforcement path for nodes without explicit per-node RolePermissions. SessionContext.getApplicableRolePermissions reads a missing or null DefaultRolePermissions metadata value instead of the configured namespace field, and the null result is treated permissively. An anonymous network client can consequently write variables with CurrentWrite access or call bound methods when an operator configured a restrictive namespace default and relied on inheritance. Servers with no declared policy, nodes with explicit per-node permissions, and correctly bound programmatic namespace metadata are outside the authorization-bypass case. This issue is fixed in version 2.180.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "node-opcua",
          "product": "node-opcua",
          "versions": [
            {
              "version": ">= 2.42.0, < 2.180.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.2
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-285"
        },
        {
          "lang": "en",
          "value": "CWE-636"
        },
        {
          "lang": "en",
          "value": "CWE-863"
        },
        {
          "lang": "en",
          "value": "CWE-1188"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/node-opcua/node-opcua/commit/0261e873900800983c622e01120f484dc6063698",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/node-opcua/node-opcua/pull/1580",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/node-opcua/node-opcua/releases/tag/v2.180.0",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/node-opcua/node-opcua/security/advisories/GHSA-xggf-m53x-jc3f",
      "source": "[email protected]"
    }
  ]
}