Live › vulnerability › CVE-2026-95860
node-opcua, an OPC UA server library for Node.js and TypeScript, fails to apply namespace-level default role permissions to nodes without explicit per-node permissions. An anonymous network client can write variables marked CurrentWrite or call bound methods that the operator meant to restrict.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 21:19 UTC. All times on this page are UTC.
Servers built on node-opcua from 2.42.0 to before 2.180.0 that configure a restrictive namespace default with setDefaultRolePermissions and rely on nodes inheriting it. Servers with no declared permission policy, nodes with explicit per-node RolePermissions, and correctly bound programmatic namespace metadata are not in the bypass case.
No product ranges from the sources yet.
npm ls node-opcua, looking for versions from 2.42.0 up to before 2.180.0.setDefaultRolePermissions to see whether a restrictive namespace default is relied on for inheritance.2.180.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
node-opcua is an OPC UA implementation for TypeScript and Node.js. From 2.42.0 until 2.180.0, namespace-level access control configured through setDefaultRolePermissions is not honored by the runtime enforcement path for nodes without explicit per-node RolePermissions. SessionContext.getApplicableRolePermissions reads a missing or null DefaultRolePermissions metadata value instead of the configured namespace field, and the null result is treated permissively. An anonymous network client can consequently write variables with CurrentWrite access or call bound methods when an operator configured a restrictive namespace default and relied on inheritance. Servers with no declared policy, nodes with explicit per-node permissions, and correctly bound programmatic namespace metadata are outside the authorization-bypass case. This issue is fixed in version 2.180.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-95860")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.