node-opcua: Namespace-level RBAC bypass (CVE-2026-95860)

node-opcua is affected by an authorization bypass vulnerability (CVE-2026-95860) occurring in versions 2.42.0 through 2.179.0. The vulnerability stems from a flaw in SessionContext.getApplicableRolePermissions, which fails to correctly read DefaultRolePermissions metadata when per-node RolePermissions are not explicitly defined. Instead of inheriting restrictive defaults, the runtime treats the missing configuration as permissive. This allows anonymous network clients to write to variables or call bound methods that were intended to be protected by namespace-level access controls.

Impact

Successful exploitation allows unauthenticated remote attackers to bypass namespace-level authorization, granting them the ability to modify variables or execute functions on the OPC UA server that should otherwise be restricted. Servers with no declared default policies, or those using explicit per-node permissions, are not impacted.

Recommendation

• Upgrade node-opcua to version 2.180.0 or later to patch the underlying logic error.
• Review OPC UA server configurations to ensure that per-node permissions are explicitly defined rather than relying solely on namespace-level default inheritance until the upgrade is completed.
• Identify all instances of the node-opcua package within the environment and verify the version against the vulnerable range (2.42.0 <= version < 2.180.0).