International
The Morning Dev

Only the news worth knowing

‹
 
B45/100

Vulnerability · critical · CVSS 9.1

node-opcua namespace RBAC fail-open allows anonymous writes (CVE-2026-95860)

Tier B · Patch this week – Put it in the sprint

Who’s exposed: Node-opcua servers exposing nodes without explicit per-node permissions to anonymous clients

Tier B because: Exploited in the wild OR public exploit

Reach

Attack

Damage

Fix

Public exploit · Remote, no login · Full takeover

What to do

  1. Check the GitHub advisory for the patched versions and upgrade node-opcua, node-opcua-address-space and node-opcua-server.
  2. Set explicit per-node permissions on sensitive Variables and Methods rather than relying on inherited DefaultRolePermissions.

The Brief

  • GitHub Advisory Database published GHSA-xggf-m53x-jc3f on 2026-11-10 for node-opcua, tracked as CVE-2026-95860.
  • Affected packages are node-opcua, node-opcua-address-space and node-opcua-server.
  • Per the advisory summary, an anonymous client can write protected Variables and call privileged Methods on nodes without explicit per-node permissions.

Why it matters

Servers built on node-opcua may accept unauthenticated writes and method calls on nodes that developers assumed were protected by namespace-level RBAC.

The checklist behind the tier

Checklist · 4 of 10 yes
YesHits tech teamsJudgment: node-opcua is a Node.js library and server framework that developers build and run with.
NoCore infrastructureJudgment: a niche OPC UA library, not software nearly every team runs.
NoPopular toolJudgment: used mainly in industrial OPC UA niche, not a mainstream developer tool.
NoExploited in the wildGitHub Advisory Database: describes the flaw only; no observed attacks reported.
YesPublic exploitCISA SSVCCISA rates exploitation of CVE-2026-95860 as proof of concept public
YesRemote, no loginCVSSCVE-2026-95860: CVSS 9.1 – network, no privileges, no user interaction
YesFull takeoverCVSSCVE-2026-95860: CVSS rates confidentiality and integrity impact high
NoSecrets exposedGitHub Advisory Database: describes unauthorized writes and calls; no data theft or exposure reported.
NoSupply chainGitHub Advisory Database: a normal authorization bug in legitimate code, not malicious code shipped.
NoNo fix yetGitHub AdvisoryGitHub Advisory: node-opcua fixed in 2.180.0 (+2 more packages)

The official record

From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.

  • CVE-2026-95860 ↗CVSS 9.1 critical AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

    node-opcua: Namespace-Level RBAC Fail-Open - Anonymous Write/Call Bypass via Unbound `DefaultRolePermissions

    Exploited
    Proof of concept public (CISA)
    EPSS
    <1% chance of exploitation in the next 30 days · higher than 49% of all CVEs
    Fix
    • node-opcua (npm) fixed in 2.180.0
    • node-opcua-address-space (npm) fixed in 2.180.0
    • node-opcua-server (npm) fixed in 2.180.0
    Weakness
    CWE-285, CWE-636, CWE-863, CWE-1188

    NVDGHSA-xggf-m53x-jc3f

Timeline

  1. Advisory GHSA-xggf-m53x-jc3f published in GitHub Advisory Database

  2. GitHub Advisory Database

    node-opcua: Namespace-Level RBAC Fail-Open - Anonymous Write/Call Bypass via Unbound `DefaultRolePermissions (CVE-2026-95860)

Source

node-opcua: Namespace-Level RBAC Fail-Open - Anonymous Write/Call Bypass via Unbound `DefaultRolePermissions (CVE-2026-95860) ↗ GitHub Advisory Database · 2h ago

First seen · 1 source · Full story page · How tiers are decided