CVE-2026-58080: High severity Eclipse Milo OpcUaServerConfig.copy() vulnerability
In Eclipse Milo versions 1.0.0 through 1.1.4, OpcUaServerConfig.copy() fails to preserve a configured RoleMapper. On servers that rely on role permissions and construct the running configuration through copy(), sessions receive no role IDs and the default access controller skips role-permission checks, allowing an anonymous client where anonymous sessions are permitted to read role-permission metadata, invoke protected methods, or delete protected nodes.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Operational
After upgrading, recreate or refresh the server running configuration that was constructed via OpcUaServerConfig.copy() to ensure the configured RoleMapper is preserved and sessions receive role IDs.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-58080?
CVE-2026-58080 has a risk score of 60.
How do I fix CVE-2026-58080?
To fix CVE-2026-58080, update to a version of Eclipse Milo later than 1.1.4.
What impact does CVE-2026-58080 have on Eclipse Milo?
CVE-2026-58080 may result in sessions receiving no role IDs, leading to skipped role-based permissions.
Which versions of Eclipse Milo are affected by CVE-2026-58080?
CVE-2026-58080 affects Eclipse Milo versions 1.0.0 through 1.1.4.
What specific function is vulnerable in CVE-2026-58080?
The function `OpcUaServerConfig.copy()` is vulnerable in CVE-2026-58080.