# CVE-2026-95860

Auth bypass in node-opcua allows anonymous write/call on OPC UA servers.

- Page: https://www.vulneraibility.com/cve/CVE-2026-95860
- CVSS: 9.1
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 0.60% (percentile 48.6)
- Weakness: CWE-285, CWE-636, CWE-863, CWE-1188
- Also known as: GHSA-xggf-m53x-jc3f
- Published: 2026-11-03

## Affected versions

- node-opcua: affected >= 2.42.0 and < 2.180.0

A version outside these ranges is not a statement that it is unaffected.

## Impact

Anonymous network attacker can bypass namespace RolePermissions to write variables and invoke methods, altering OT process state and enabling disruptive actions.

## Action

Immediate action required

## Recommendation

Upgrade node-opcua to >=2.180.0; restrict network access to OPC UA endpoints and audit logs.

## References

- [other] https://github.com/node-opcua/node-opcua/security/advisories/GHSA-xggf-m53x-jc3f
- [other] https://github.com/node-opcua/node-opcua/pull/1580
- [other] https://github.com/node-opcua/node-opcua/commit/0261e873900800983c622e01120f484dc6063698
- [other] https://github.com/node-opcua/node-opcua/releases/tag/v2.180.0

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.