CVE-2026-58080: Eclipse Milo OpcUaServerConfig.copy() vulnerability
In Eclipse Milo versions 1.0.0 through 1.1.4, OpcUaServerConfig.copy() fails to preserve a configured RoleMapper. On servers that rely on role permissions and construct the running configuration through copy(), sessions receive no role IDs and the default access controller skips role-permission checks, allowing an anonymous client where anonymous sessions are permitted to read role-permission metadata, invoke protected methods, or delete protected nodes.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-58080?
CVE-2026-58080 has a risk score of 60.
How do I fix CVE-2026-58080?
To fix CVE-2026-58080, update to a version of Eclipse Milo later than 1.1.4.
What impact does CVE-2026-58080 have on Eclipse Milo?
CVE-2026-58080 may result in sessions receiving no role IDs, leading to skipped role-based permissions.
Which versions of Eclipse Milo are affected by CVE-2026-58080?
CVE-2026-58080 affects Eclipse Milo versions 1.0.0 through 1.1.4.
What specific function is vulnerable in CVE-2026-58080?
The function `OpcUaServerConfig.copy()` is vulnerable in CVE-2026-58080.