CVE-2026-58080 Details
Description
In Eclipse Milo versions 1.0.0 through 1.1.4, `OpcUaServerConfig.copy()` fails to preserve a configured `RoleMapper`. On servers that rely on role permissions and construct the running configuration through `copy()`, sessions receive no role IDs and the default access controller skips role-permission checks, allowing an anonymous client where anonymous sessions are permitted to read role-permission metadata, invoke protected methods, or delete protected nodes.
A vulnerability exists in Eclipse Milo versions 1.0.0 through 1.1.4, where the 'OpcUaServerConfig.copy()' method does not properly copy the 'RoleMapper' configuration. This oversight can lead to a bypass of role-based access control (RBAC) on servers that depend on role permissions. When the 'copy()' method is used to replicate the server configuration, the resulting sessions lack role IDs. Consequently, the default access controller omits role-permission checks, allowing an anonymous client (where such sessions are permitted) to access role-permission metadata, invoke protected methods, or delete safeguarded nodes.
Update to Eclipse Milo version 1.1.6 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/eclipse-milo/milo/commit/d51f03e9a75f313ab41c3d68d809f4b922073f1a | [email protected] | Patch |
| https://gitlab.eclipse.org/security/cve-assignment/-/work_items/180 | [email protected] | Issue TrackingPatchVendor Advisory |
| https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/598 | [email protected] | Issue TrackingVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| eclipse milo | >= 1.0.0, < 1.1.5 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 5, 2026 | Initial Analysis | [email protected] |
| Aug 4, 2026 | CVE Modified | CISA-ADP |
| Aug 4, 2026 | New CVE Received | [email protected] |