WhatBrokeToday
FAQ
Today's Trends
criticalInvestigatingnpmv>= 2.42.0, < 2.180.0

node-opcua Namespace-Level RBAC Fail-Open Vulnerability

  1. Investigating(current)
  2. Trending(upcoming)
  3. Workaround available(upcoming)
  4. Resolved(upcoming)

Executive summary

An unauthenticated client can write protected variables and call privileged methods on nodes lacking explicit per-node permissions in node-opcua due to a namespace-level RBAC fail-open flaw. Users are affected across node-opcua, node-opcua-address-space, and node-opcua-server versions >= 2.42.0 and < 2.180.0.

No verified workaround yet

None of the linked reports describe a mitigation. Follow this incident to hear when one appears.

Official fix
Technical root cause

Namespace-level RBAC fail-open via unbound DefaultRolePermissions allowing anonymous write and call bypasses.

Evidence

1 report · 1 CVEShow
  1. [1]
    CVE First report
    node-opcua: Namespace-Level RBAC Fail-Open - Anonymous Write/Call Bypass via Unbound `DefaultRolePermissions(opens security advisory in a new tab)

    Fixed in: node-opcua 2.180.0, node-opcua-address-space 2.180.0, node-opcua-server 2.180.0. Critical severity (CVE-2026-95860). Affected: node-opcua (npm) >= 2.42.0, < 2.180.0; node-opcua-address-space (npm) >= 2.42.0, < 2.180.0; node-opcua-server (npm) >= 2.42.0, < 2.180.0. ## Summary An unauthenticated (**Anonymous**) client can **Write** protected Variables and **Call** privileged Methods on any Node that lacks explicit per-node permissions. This follows the inheritance model defined by OPC…

    by GitHub Advisory Database 0upvotes 0comments

Timeline

  1. First report on security advisory

    node-opcua: Namespace-Level RBAC Fail-Open - Anonymous Write/Call Bypass via Unbound `DefaultRolePermissions

    Source