CVE-2026-58080: Eclipse Milo Auth Bypass Vulnerability

CVE-2026-58080 Overview

CVE-2026-58080 is a missing authorization vulnerability [CWE-862] in Eclipse Milo, an open-source OPC UA (Open Platform Communications Unified Architecture) implementation used in industrial control and IoT systems. The flaw exists in versions 1.0.0 through 1.1.4, where OpcUaServerConfig.copy() fails to preserve a configured RoleMapper. Servers that construct their running configuration through copy() lose role-based access controls. Sessions receive no role IDs, and the default access controller skips role-permission checks. Anonymous clients on servers permitting anonymous sessions can read role-permission metadata, invoke protected methods, or delete protected nodes.

Critical Impact
Anonymous attackers can bypass role-based access controls to invoke protected methods and delete protected nodes on affected OPC UA servers.

Affected Products

Eclipse Milo 1.0.0 through 1.1.4
OPC UA servers built on Eclipse Milo that rely on RoleMapper for authorization
Industrial control system integrations using affected Milo versions

Discovery Timeline

2026-08-04 - CVE-2026-58080 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-58080

Vulnerability Analysis

Eclipse Milo implements the OPC UA specification, which supports role-based permissions on nodes and methods. Server operators configure a RoleMapper to assign role identifiers to authenticated and anonymous sessions. The default access controller then evaluates role permissions before granting operations on protected resources.

The defect resides in OpcUaServerConfig.copy(). This routine reconstructs a builder from an existing configuration but omits the RoleMapper field. When downstream code passes the server configuration through copy(), the reconstructed configuration loses its role mapping logic. Sessions therefore receive no role IDs.

When role IDs are absent, the default access controller treats role-permission enforcement as inapplicable and skips those checks entirely. Nodes and methods that were meant to be gated behind role membership become reachable by any session that can reach the server.

Root Cause

The copy() method in OpcUaServerConfig fails to invoke builder.setRoleMapper() when reconstructing the configuration builder from a source configuration. Other configuration fields such as limits, identity validator, certificate manager, executor, and security keys listener are preserved, but the role mapper is silently dropped. This inconsistent field copying is the classic pattern behind missing authorization defects [CWE-862].

Attack Vector

An unauthenticated network-adjacent attacker connects to an affected OPC UA server that permits anonymous sessions. Because the reconstructed configuration lacks a RoleMapper, the anonymous session bypasses role-permission checks. The attacker can then:

Read RolePermissions and UserRolePermissions attributes exposing access-control metadata
Invoke methods flagged as protected by role permissions
Delete nodes that role permissions were meant to safeguard

java

// Patch: Preserve role mappings when copying server config (#1801)
// File: opc-ua-sdk/sdk-server/src/main/java/org/eclipse/milo/opcua/sdk/server/OpcUaServerConfig.java
     builder.setLimits(config.getLimits());
     builder.setIdentityValidator(config.getIdentityValidator());
     builder.setCertificateManager(config.getCertificateManager());
+    config.getRoleMapper().ifPresent(builder::setRoleMapper);
     builder.setExecutor(config.getExecutor());
     builder.setScheduledExecutor(config.getScheduledExecutorService());
     config.getSecurityKeysListener().ifPresent(builder::setSecurityKeysListener);

Source: Eclipse Milo Commit d51f03e

Detection Methods for CVE-2026-58080

Indicators of Compromise

Anonymous OPC UA sessions performing Read operations against RolePermissions or UserRolePermissions attributes
Unexpected Call service requests from anonymous sessions targeting methods marked with role permissions
DeleteNodes service requests originating from anonymous sessions
Session diagnostics showing sessions with empty role ID sets on servers configured to use a RoleMapper

Detection Strategies

Enumerate the running Milo version through dependency inventories and flag any instance in the 1.0.0 through 1.1.4 range
Audit server initialization code to identify whether the runtime configuration passes through OpcUaServerConfig.copy()
Review OPC UA server audit logs for anonymous sessions accessing nodes marked with role-based permissions

Monitoring Recommendations

Enable OPC UA audit events (AuditSessionEventType, AuditNodeManagementEventType) and forward them to a centralized log platform
Alert on DeleteNodes and protected Call requests from sessions whose role ID collection is empty
Baseline expected anonymous-session activity and alert on deviations touching security-sensitive nodes

How to Mitigate CVE-2026-58080

Immediate Actions Required

Upgrade Eclipse Milo to a fixed release beyond 1.1.4 that includes commit d51f03e
Disable anonymous session support on any exposed OPC UA server until patched, if operationally feasible
Restrict network reachability of OPC UA servers (TCP port 4840 by default) to trusted management networks
Review and remove any unnecessary role-permission-protected methods that could be abused if authorization bypass occurs

Patch Information

The fix is delivered in Eclipse Milo commit d51f03e9a75f313ab41c3d68d809f4b922073f1a, which adds config.getRoleMapper().ifPresent(builder::setRoleMapper); to OpcUaServerConfig.copy(). Additional coordination details are available in the Eclipse GitLab CVE assignment and the Eclipse Vulnerability Report.

Workarounds

Avoid constructing the running configuration through OpcUaServerConfig.copy(); build the OpcUaServerConfig directly and set the RoleMapper on the builder before starting the server
Configure the server to reject anonymous sessions by removing anonymous user tokens from the identity validator
Enforce role permissions through a custom AccessController that fails closed when a session has no role IDs

bash

# Example: pin Eclipse Milo to a patched version in Maven
mvn versions:set-property -Dproperty=milo.version -DnewVersion=1.1.5
mvn versions:use-latest-versions -Dincludes=org.eclipse.milo:*
mvn dependency:tree | grep -i milo