# node-opcua: Namespace-Level RBAC Fail-Open - Anonymous Write/Call Bypass via Unbound `DefaultRolePermissions (CVE-2026-95860)

Source: [GitHub Advisory Database](https://github.com/advisories/GHSA-xggf-m53x-jc3f) · 2026-11-10 · Security
Page: https://themorning.dev/story/node-opcua-namespace-level-rbac-fail-open-anonymous-write-call-bypass-via-unboun-f2730df02d619c18
Kind: security · Impact: high

## In brief

- GitHub Advisory Database published GHSA-xggf-m53x-jc3f on 2026-11-10 for node-opcua, tracked as CVE-2026-95860.
- Affected packages are node-opcua, node-opcua-address-space and node-opcua-server.
- Per the advisory summary, an anonymous client can write protected Variables and call privileged Methods on nodes without explicit per-node permissions.

## Why it matters

Servers built on node-opcua may accept unauthenticated writes and method calls on nodes that developers assumed were protected by namespace-level RBAC.

## What to do

- Check the GitHub advisory for the patched versions and upgrade node-opcua, node-opcua-address-space and node-opcua-server.
- Set explicit per-node permissions on sensitive Variables and Methods rather than relying on inherited DefaultRolePermissions.

## CVEs

- CVE-2026-95860

## Timeline

- 2026-11-10: Advisory GHSA-xggf-m53x-jc3f published in GitHub Advisory Database

## Coverage

- [node-opcua: Namespace-Level RBAC Fail-Open - Anonymous Write/Call Bypass via Unbound `DefaultRolePermissions (CVE-2026-95860)](https://github.com/advisories/GHSA-xggf-m53x-jc3f) — GitHub Advisory Database, 2026-11-10

Tags: opc-ua, node-opcua, vulnerability, access-control, rbac, anonymous-access

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev