CVE-2026-58080

Name of the Vulnerable Software and Affected Versions Eclipse Milo versions 1.0.0 through 1.1.4

Description The OpcUaServerConfig.copy() function fails to preserve a configured RoleMapper. On servers that rely on role permissions and construct the running configuration using copy(), sessions are not assigned role IDs. Consequently, the default access controller bypasses role-permission checks. This allows anonymous clients, in environments where anonymous sessions are permitted, to read role-permission metadata, invoke protected methods, or delete protected nodes.

Recommendations Update Eclipse Milo to a version later than 1.1.4. As a temporary mitigation, avoid using the OpcUaServerConfig.copy() function to construct the running configuration if the server relies on role permissions.