Read the docs
TI-2026-84561 Aliases CVE-2026-95860

Authorization bypass in node-opcua lets anonymous clients write

Priority HIGH 80CWE-1188Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-285.

Summary

node-opcua from 2.42.0 before 2.180.0 does not honor namespace-level default role permissions for nodes without explicit per-node permissions. A missing or null default is read in place of the configured namespace value and treated permissively, which fails open (CWE-636). An anonymous network client can write variables with CurrentWrite access or call bound methods on servers where an operator set a restrictive namespace default and relied on inheritance.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

Description from the CNA

node-opcua is an OPC UA implementation for TypeScript and Node.js. From 2.42.0 until 2.180.0, namespace-level access control configured through setDefaultRolePermissions is not honored by the runtime enforcement path for nodes without explicit per-node RolePermissions. SessionContext.getApplicableRolePermissions reads a missing or null DefaultRolePermissions metadata value instead of the configured namespace field, and the null result is treated permissively. An anonymous network client can consequently write variables with CurrentWrite access or call bound methods when an operator configured a restrictive namespace default and relied on inheritance. Servers with no declared policy, nodes with explicit per-node permissions, and correctly bound programmatic namespace metadata are outside the authorization-bypass case. This issue is fixed in version 2.180.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00596 48th percentileScored 2026-11-07
Fix Fixed node-opcua (node-opcua): 2.180.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
node-opcuanode-opcua2.42.0 to before 2.180.02.180.0Patch availableCNA
  • node-opcua Vendornode-opcua Affected 2.42.0 to before 2.180.0 Fixed in 2.180.0 Patch available CNA

Remediation

Upgrade node-opcua to version 2.180.0, which fixes this issue. The sources list no other fixed version for node-opcua.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

  • Fix · CNA node-opcua (node-opcua) Fixed in 2.180.0

Timeline

  1. 2026-11-03 Threatist record created from CVE-2026-95860
  2. 2026-11-07 CISA SSVC decision points changed
  3. 2026-11-07 Priority changed: MEDIUM → HIGH

References

Other 4

  • TI-2026-48544 node-opcua: Prototype Pollution via internal `fieldsToJson()` implementation (Related to CVE-2024-57086) CVSS 3.1LOW 3.7
  • TI-2026-39066 node-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoS CVSS 3.1HIGH 7.5
  • TI-2026-39065 node-opcua: Missing nonce verification in UserNameIdentityToken authentication CVSS 3.1HIGH 7.7
  • TI-2026-48457 node-opcua: TCP Socket Leak (FIN-WAIT-2) via keepalive reconnection cycle - Resource Exhaustion CVSS 3.1HIGH 7.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences