CVE-2026-58080

HighCVSS 8.2/10Last modified Oct 23, 2026

Description

In Eclipse Milo versions 1.0.0 through 1.1.4, `OpcUaServerConfig.copy()` fails to preserve a configured `RoleMapper`. On servers that rely on role permissions and construct the running configuration through `copy()`, sessions receive no role IDs and the default access controller skips role-permission checks, allowing an anonymous client where anonymous sessions are permitted to read role-permission metadata, invoke protected methods, or delete protected nodes.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
Eclipse Foundation	Eclipse Milo	>= 1.0.0, < 1.1.5

References

https://github.com/eclipse-milo/milo/commit/d51f03e9a75f313ab41c3d68d809f4b922073f1aPatch
https://gitlab.eclipse.org/security/cve-assignment/-/work_items/180Issue Tracking, Patch, Vendor Advisory
https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/598Issue Tracking, Vendor Advisory

Timeline

Published: Aug 4, 2026
Last modified: Oct 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-580819.8Several encoding modules, including HZ, UTF-7, VIQR, and ZW, did not properly check the size of the caller-supplied output buffer before wri CVE-2026-580829.8The ISO-2022 encoding module used a stack buffer sized to MB_LEN_MAX (6 bytes) for intermediate character output. Some ISO-2022 variants ca CVE-2026-580838.4While the kernel was copying knotes during fork, a knote with a timer-based filter could fire and be enqueued on the kqueue's active list be CVE-2026-580845.5To retrieve the previous timer value, the kernel calls realtimer_gettime(), which obtains the current time for the timer's clock. For a tim CVE-2026-580857.5After dispatching a decrypt operation to OCF and receiving the result, the wg(4) driver failed to check whether the MAC verification step su CVE-2026-580868.1As an inadvertent side effect of an unrelated code change, PRIV_KTRACE was always denied to a jailed root user. Tracing configured by a jai CVE-2026-580877.8The GETALL and SETALL commands in semctl(2) recorded the number of semaphores in the target set, dropped the lock protecting the set, alloca CVE-2026-580887.4The ELF core dump code counted the number of dumpable VM map entries, allocated a buffer for the corresponding program headers, then iterate CVE-2026-580897.8When a process calls execve(2) to execute a setuid or setgid image, hwpmc(4) is supposed to detach PMCs owned by unprivileged processes. An CVE-2026-58097.1The wpForo Forum plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to and including 3.0.2. This is due to a two-s CVE-2026-580907.8The SOCK_STREAM receive path in the unix socket implementation failed to fully detach control messages from the socket buffer before process CVE-2026-580917.8The implementation of this ioctl attempts to acquire locks on all channels in a sync group. If locking a channel would block, it releases t