{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/node-opcua-2.42.0-2.179.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:node-opcua:node-opcua:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.1,"id":"CVE-2026-95860"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["node-opcua (2.42.0-2.179.0)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","rbac","opc-ua","node-opcua","authorization-bypass"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003enode-opcua is affected by an authorization bypass vulnerability (CVE-2026-95860) occurring in versions 2.42.0 through 2.179.0. The vulnerability stems from a flaw in \u003ccode\u003eSessionContext.getApplicableRolePermissions\u003c/code\u003e, which fails to correctly read \u003ccode\u003eDefaultRolePermissions\u003c/code\u003e metadata when per-node \u003ccode\u003eRolePermissions\u003c/code\u003e are not explicitly defined. Instead of inheriting restrictive defaults, the runtime treats the missing configuration as permissive. This allows anonymous network clients to write to variables or call bound methods that were intended to be protected by namespace-level access controls.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated remote attackers to bypass namespace-level authorization, granting them the ability to modify variables or execute functions on the OPC UA server that should otherwise be restricted. Servers with no declared default policies, or those using explicit per-node permissions, are not impacted.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade node-opcua to version 2.180.0 or later to patch the underlying logic error.\u003c/li\u003e\n\u003cli\u003eReview OPC UA server configurations to ensure that per-node permissions are explicitly defined rather than relying solely on namespace-level default inheritance until the upgrade is completed.\u003c/li\u003e\n\u003cli\u003eIdentify all instances of the \u003ccode\u003enode-opcua\u003c/code\u003e package within the environment and verify the version against the vulnerable range (2.42.0 \u0026lt;= version \u0026lt; 2.180.0).\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-04T00:47:18Z","date_published":"2026-11-04T00:47:18Z","id":"https://feed.craftedsignal.io/briefs/2026-11-node-opcua-rbac-bypass/","summary":"A namespace-level RBAC fail-open vulnerability in node-opcua (CVE-2026-95860) allows unauthenticated network clients to perform unauthorized writes or method calls due to improper role permission inheritance.","title":"node-opcua: Namespace-level RBAC bypass (CVE-2026-95860)","url":"https://feed.craftedsignal.io/briefs/2026-11-node-opcua-rbac-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Node-Opcua (2.42.0-2.179.0)","version":"https://jsonfeed.org/version/1.1"}