Security · High impactFan score 45 · Tier B
node-opcua: Namespace-Level RBAC Fail-Open - Anonymous Write/Call Bypass via Unbound `DefaultRolePermissions (CVE-2026-95860)
The Brief
- GitHub Advisory Database published GHSA-xggf-m53x-jc3f on 2026-11-10 for node-opcua, tracked as CVE-2026-95860.
- Affected packages are node-opcua, node-opcua-address-space and node-opcua-server.
- Per the advisory summary, an anonymous client can write protected Variables and call privileged Methods on nodes without explicit per-node permissions.
Why it matters
Servers built on node-opcua may accept unauthenticated writes and method calls on nodes that developers assumed were protected by namespace-level RBAC.
Who’s affected
- Teams running node-opcua servers
- Teams using node-opcua-address-space or node-opcua-server
What to do
- Check the GitHub advisory for the patched versions and upgrade node-opcua, node-opcua-address-space and node-opcua-server.
- Set explicit per-node permissions on sensitive Variables and Methods rather than relying on inherited DefaultRolePermissions.
- CVE-2026-95860
- #opc-ua
- #node-opcua
- #vulnerability
- #access-control
- #rbac
- #anonymous-access
Affects node-opcua, node-opcua-address-space, node-opcua-server. Summary An unauthenticated (Anonymous) client can Write protected Variables and Call privileged Methods on any Node that lacks explicit per-node permissions. This follows the inheritance model defined by OPC UA…
Timeline
Advisory GHSA-xggf-m53x-jc3f published in GitHub Advisory Database
GitHub Advisory Database
node-opcua: Namespace-Level RBAC Fail-Open - Anonymous Write/Call Bypass via Unbound `DefaultRolePermissions (CVE-2026-95860)