Eclipse Milo Vulnerability in OpcUaServerConfig Affecting RoleMapper Configuration
CVE-2026-58080

8.8HIGH

Key Information:

Vendor

Eclipse Foundation

Status
Eclipse Milo
Vendor
CVE Published:
4 August 2026

What is CVE-2026-58080?

In Eclipse Milo versions 1.0.0 through 1.1.4, the method OpcUaServerConfig.copy() incorrectly handles the preservation of configured RoleMapper settings. This flaw results in sessions not receiving role IDs, which can lead to unauthorized access. When role permissions are not enforced, anonymous clients can potentially read sensitive role-permission metadata, invoke protected methods, or delete protected nodes, thus compromising the server's integrity and security.

Affected Version(s)

Eclipse Milo 1.0.0 < 1.1.5

References

https://github.com/eclipse-milo/milo/commit/d51f03e9a75f3...
https://gitlab.eclipse.org/security/vulnerability-reports...
https://gitlab.eclipse.org/security/cve-assignment/-/work...

CVSS V4

Score:
8.8
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abhinav Agarwal (GitHub: @abhinavagarwal07)
.