node-opcua: anonymous Write/Call bypass via unbound DefaultRolePermissions fail-open (CVE-2026-95860)
Severity: critical · Patch status: patched · Since 2026-11-10 · CVE-2026-95860
A critical (CVSS 9.1) authorization fail-open in node-opcua lets an unauthenticated Anonymous client Write protected Variables and Call privileged Methods on nodes lacking explicit per-node permissions. When a namespace DefaultRolePermissions policy is declared via setDefaultRolePermissions(), the configuration is stored in a private field while the runtime enforcement path reads the DefaultRolePermissions UAVariable node, which resolves to null; a null policy then returns allPermissions to any role, violating OPC UA Part 3 §4.8.3 default-deny. Servers that declared no policy are not bypassed (documented permissive default). Affects versions =2.42.0, <2.180.0 of node-opcua, node-opcua-address-space and node-opcua-server. Fixed in 2.180.0; no in-the-wild exploitation known.
What to do
- Upgrade node-opcua, node-opcua-address-space and node-opcua-server to 2.180.0 or later
- If upgrading is delayed, set explicit RolePermissions on every protected node rather than relying on namespace defaults
- Audit server configurations for use of setDefaultRolePermissions() and verify enforcement with an Anonymous-client Write/Call test
- Restrict network exposure of affected OPC UA servers to trusted clients only
- Review server logs for unexpected Anonymous Write or Call activity
Fixed versions
- node-opcua 2.180.0
- node-opcua-address-space 2.180.0
- node-opcua-server 2.180.0
Sources
All live incidents on Threat Watch
