{"id":"EM-20261110-XO3K","url":"https://cyber.eventmonitor.net/incident/EM-20261110-XO3K/critical-node-opcua-vulnerability-cve-2026-95860/","type":"cve","title":"Critical node-opcua Vulnerability (CVE-2026-95860)","subtitle":"CVE-2026-95860","subject":"CVE-2026-95860","status":"Developing","severity":"critical","affected":[],"headline":null,"born":"2026-11-10T15:56:52.000Z","firstSignal":"2026-11-03T21:17:45.907Z","lastSignal":"2026-11-10T15:56:52.000Z","updated":"2026-11-10T16:07:51.148Z","revision":1,"life":[{"status":"Born","at":"2026-11-10T15:56:52.000Z","why":"second independent source: C26 GitHub Advisory Database"},{"status":"Developing","at":"2026-11-10T15:56:52.000Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-03T21:17:45.907Z","what":"First signal: C6 NVD CVE API 2.0"},{"at":"2026-11-10T15:56:52.000Z","what":"Born: second source, C26 GitHub Advisory Database. Page EM-20261110-XO3K created."}],"stages":[{"name":"Disclosed","at":"2026-11-03T21:17:45.907Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-03T21:17:45.907Z","detail":"CVSS 9.1 · EPSS 0.6%"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":null,"detail":"None in sources yet"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-03T21:17:45.907Z","source":"C6","sourceName":"NVD CVE API 2.0","role":"Database","severity":4,"title":"CVE-2026-95860 (CVSS 9.1)","text":"node-opcua is an OPC UA implementation for TypeScript and Node.js. From 2.42.0 until 2.180.0, namespace-level access control configured through setDefaultRolePermissions is not honored by the runtime enforcement path for nodes without explicit per-node RolePermissions. SessionContext.getApplicableRolePermissions reads a missing or null DefaultRolePermissions metadata value instead of the configured namespace field, and the null result is treated permissively. An anonymous network client can consequently write variables with CurrentWrite access or call bound methods when an operator…","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95860"},{"at":"2026-11-10T15:56:52.000Z","source":"C26","sourceName":"GitHub Advisory Database","role":"Database","severity":4,"title":"GHSA-xggf-m53x-jc3f / CVE-2026-95860: node-opcua: Namespace-Level RBAC Fail-Open - Anonymous Write/Call Bypass via Unbound `DefaultRolePermissions","text":"npm:node-opcua, npm:node-opcua-address-space, npm:node-opcua-server","url":"https://github.com/advisories/GHSA-xggf-m53x-jc3f"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-03T21:17:45.907","score":9.1,"severity":"CRITICAL","desc":"node-opcua is an OPC UA implementation for TypeScript and Node.js. From 2.42.0 until 2.180.0, namespace-level access control configured through setDefaultRolePermissions is not honored by the runtime enforcement path for nodes without explicit per-node RolePermissions…","product":"","seen":1794032737048},"kev":null,"epss":{"epss":0.00596,"pct":0.4861,"at":1793803438877},"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}