It affects namespace-level role permissions that operators configured to restrict access and expected unprotected nodes to inherit.The flaw can give an anonymous network client Write or Call permission when a node lacks explicit per-node RolePermissions. It does not mean every node-opcua deployment or every node is affected.
What it allows
How Does CVE-2026-95860 Bypass Namespace RBAC?
The advisory describes two disconnected permission paths. The configuration API stores namespace defaults in one field, while runtime enforcement reads a separate metadata value that can remain null.
The runtime permission check treats that null result as all permissions instead of denying the operation. A restrictive namespace default can therefore appear configured while failing to govern nodes that rely on inherited permissions.
An anonymous client may write Variables that already permit CurrentWrite or call bound Methods without explicit per-node RolePermissions. The advisory says Methods lack the additional AccessLevel gate that Variables have.
This is not the same as a server with no RolePermissions policy anywhere. The advisory calls that permissive documented behavior an insecure default, but not the CVSS 9.1 bypass.
Who is affected
Which node-opcua Versions Are Affected by CVE-2026-95860?
The GitHub advisory lists node-opcua, node-opcua-address-space, and node-opcua-server versions 2.42.0 through versions before 2.180.0. Version 2.180.0 is the patched release for all three npm packages.
The bypass requires an operator to declare a namespace default and rely on inheritance for nodes without explicit RolePermissions. Nodes with explicit per-node permissions remain enforced according to the advisory.
Variables without CurrentWrite are outside the Write path. Programmatic namespaces are also outside the bypass when both the default permissions and namespace metadata are correctly connected.
Timeline
- 2026-10-23
The GitHub security advisory was first published.
- 2026-11-03
NVD published the CVE-2026-95860 record.
- 2026-11-10
GitHub reviewed and updated the advisory.
What to do
-
Upgrade all affected node-opcua packages to 2.180.0 or later
Inventory node-opcua, node-opcua-address-space, and node-opcua-server together. Confirm the deployed dependency tree no longer contains an affected version from 2.42.0 through 2.179.x.
-
Identify nodes that rely on inherited namespace permissions
Review Variables and bound Methods without explicit per-node RolePermissions. Prioritize writable Variables and Methods whose execution could change operations or availability.
-
Test anonymous Write and Call denial after updating
In an isolated environment, confirm anonymous sessions receive an access-denied result on protected inherited nodes. Do not assume a successful configuration call proves runtime enforcement.
-
Use explicit per-node permissions as an interim control
Where an immediate upgrade is impossible, define explicit RolePermissions on sensitive nodes. The advisory states that these per-node permissions are correctly enforced.
What Brandefense can do
- Scan your domain in Brandefense Atlas, free
Atlas checks public sources for leaked credentials, phishing domains, dark web mentions and data sales, then gives your domain a risk grade. Free, no sign-up.
- Vulnerability Intelligence
Brandefense Vulnerability Intelligence follows which vulnerabilities attackers are using, so your team can patch what is under attack first.
Frequently Asked Questions
What is CVE-2026-95860?
It is a node-opcua authorization bypass involving namespace-level role permissions. A configured restrictive default may not reach runtime enforcement for nodes that rely on inherited permissions.
Which node-opcua packages are affected by CVE-2026-95860?
The advisory lists node-opcua, node-opcua-address-space, and node-opcua-server from version 2.42.0 through versions before 2.180.0.
Can CVE-2026-95860 affect every node-opcua server?
No. The bypass case requires a declared namespace policy that is silently ignored for nodes without explicit per-node RolePermissions. The advisory lists several unaffected configurations.
How should teams remediate CVE-2026-95860?
Upgrade the three affected packages to version 2.180.0 or later. Then test that anonymous sessions cannot Write or Call protected nodes that inherit namespace permissions.
Is CVE-2026-95860 being exploited?
Exploitation status is unknown. CISA's November 9, 2026 KEV catalog snapshot does not list the CVE, while Brandefense Blackhole recorded one Telegram post during the 90-day review window.
Sources
- node-opcua Namespace-Level RBAC Fail-Open AdvisoryGitHub Advisory Database
- CVE-2026-95860 DetailNational Vulnerability Database
- Known Exploited Vulnerabilities CatalogCybersecurity and Infrastructure Security Agency
