{"id":"CVE-2026-58080","published":"2026-08-04T13:18:55.293","lastModified":"2026-08-05T20:27:11.010","description":"In Eclipse Milo versions 1.0.0 through 1.1.4, `OpcUaServerConfig.copy()` fails to preserve a configured `RoleMapper`. On servers that rely on role permissions and construct the running configuration through `copy()`, sessions receive no role IDs and the default access controller skips role-permission checks, allowing an anonymous client where anonymous sessions are permitted to read role-permission metadata, invoke protected methods, or delete protected nodes.","cvssScore":8.2,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","cwes":["CWE-862"],"vendors":["eclipse"],"products":["milo"],"references":[{"url":"https://github.com/eclipse-milo/milo/commit/d51f03e9a75f313ab41c3d68d809f4b922073f1a","tags":["Patch"]},{"url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/180","tags":["Issue Tracking","Patch","Vendor Advisory"]},{"url":"https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/598","tags":["Issue Tracking","Vendor Advisory"]}],"exploitRefs":[{"url":"https://github.com/eclipse-milo/milo/commit/d51f03e9a75f313ab41c3d68d809f4b922073f1a","tags":["Patch"]}],"hasPoc":true,"ai":{"summary":"The flaw allows an anonymous client to read role-permission metadata, invoke protected methods, or delete protected nodes on servers that rely on role permissions and use the `copy()` method to construct the running configuration, potentially leading to unauthorized access.","exploitability":"Exploitation is moderately hard as it requires the server to use the `copy()` method and have anonymous sessions permitted. Precondition is the presence of role permissions on the server.","blast_radius":"If exploited, the impact could be significant, as it allows unauthorized access to protected nodes and methods, potentially leading to data theft or system compromise.","remediation":"Upgrade to Eclipse Milo version 1.1.5 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","ics","config-flaw"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-03T08:59:58.210Z"}}