CVE-2026-95860 Details
Description
node-opcua is an OPC UA implementation for TypeScript and Node.js. From 2.42.0 until 2.180.0, namespace-level access control configured through setDefaultRolePermissions is not honored by the runtime enforcement path for nodes without explicit per-node RolePermissions. SessionContext.getApplicableRolePermissions reads a missing or null DefaultRolePermissions metadata value instead of the configured namespace field, and the null result is treated permissively. An anonymous network client can consequently write variables with CurrentWrite access or call bound methods when an operator configured a restrictive namespace default and relied on inheritance. Servers with no declared policy, nodes with explicit per-node permissions, and correctly bound programmatic namespace metadata are outside the authorization-bypass case. This issue is fixed in version 2.180.0.
A critical authorization bypass vulnerability has been identified in node-opcua, an OPC UA implementation for TypeScript and Node.js. This vulnerability affects versions 2.42.0 prior to 2.180.0. The issue arises from a failure to properly enforce namespace-level access control permissions, allowing anonymous clients to write to variables or call methods on nodes that do not have explicit per-node RolePermissions assigned. The vulnerability is rooted in a disconnect between the permission configuration API and the runtime enforcement path, leading to a fail-open scenario where default-deny principles are inverted, granting all permissions to anonymous users.
Users can upgrade to node-opcua version 2.180.0, which addresses the vulnerability by ensuring that namespace default role permissions are properly enforced for all nodes.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 3, 2026CISA-ADP
Assessed Nov 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/node-opcua/node-opcua/security/advisories/GHSA-xggf-m53x-jc3f | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/node-opcua/node-opcua/commit/0261e873900800983c622e01120f484dc6063698 | [email protected] | Source CodeVendor |
| https://github.com/node-opcua/node-opcua/pull/1580 | [email protected] | Source CodeVendor |
| https://github.com/node-opcua/node-opcua/releases/tag/v2.180.0 | [email protected] | Release NotesVendor |
| https://github.com/node-opcua/node-opcua/security/advisories/GHSA-xggf-m53x-jc3f | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1188 | Initialization of a Resource with an Insecure Default | [email protected] |
| CWE-285 | Improper Authorization | [email protected] |
| CWE-636 | Not Failing Securely ('Failing Open') | [email protected] |
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| node-opcua | >= 2.42.0 (semver) |
CPE
Remediation
| |
| node-opcua-address-space | >= 2.42.0 (semver) |
CPE
Remediation
| |
| node-opcua-server | >= 2.42.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 7, 2026 | CVE Modified | CISA-ADP |
| Nov 3, 2026 | New CVE Received | [email protected] |