Which versions of Eclipse Milo are affected by CVE-2026-58080?

Eclipse Milo OPC UA server SDK versions 1.0.0 through 1.1.4 contain an authorization bypass vulnerability (CVSS 8.8) allowing unauthenticated attackers to invoke protected operations, access…. A patch is available.

How to fix or mitigate CVE-2026-58080?

Within 24 hours, inventory all systems running Eclipse Milo SDK versions 1.0.0 through 1.1.4 and document their network exposure, particularly any instances accessible from untrusted networks. Within 7 days, implement network segmentation to restrict OPC UA server access to authorized clients only, deploy firewall rules limiting connections to known-trusted endpoints, enable detailed audit logging for all OPC UA method invocations and node modifications, and disable OPC UA services on systems where it is not operationally required. Within 30 days, establish a monitoring baseline for normal OPC UA traffic patterns to support anomaly detection, evaluate deployment of an authentication proxy or Web Application Firewall in front of OPC UA endpoints as an additional control, and monitor Eclipse Milo's release schedule for availability of a patched version to plan a timely upgrade.

Eclipse Milo CVE-2026-58080

Q: What is the CVSS score of CVE-2026-58080?

CVE-2026-58080 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-52663 HIGH

Missing Authorization (CWE-862)

2026-08-04 eclipse

GHSA-pvvm-cxq7-hrgr

Authentication Bypass Eclipse Milo Eclipse Foundation

8.8

CVSS 4.0 · Vendor: eclipse

Severity by source

Vendor (eclipse) PRIMARY

8.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.2 HIGH

Network vector, no credentials needed when anonymous sessions are permitted; high integrity impact from unguarded method invocation and node deletion; limited confidentiality exposure (metadata only); no availability impact described.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (eclipse).

CVSS VectorVendor: eclipse

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Aug 04, 2026 - 13:16 EUVD

Source Code Evidence Fetched

Aug 04, 2026 - 13:08 vuln.today

Analysis Generated

Aug 04, 2026 - 13:08 vuln.today

CVE Published

Aug 04, 2026 - 12:05 cve.org

HIGH 8.8

DescriptionCVE.org

In Eclipse Milo versions 1.0.0 through 1.1.4, OpcUaServerConfig.copy() fails to preserve a configured RoleMapper. On servers that rely on role permissions and construct the running configuration through copy(), sessions receive no role IDs and the default access controller skips role-permission checks, allowing an anonymous client where anonymous sessions are permitted to read role-permission metadata, invoke protected methods, or delete protected nodes.

AnalysisAI

Silent authorization bypass in Eclipse Milo OPC UA server SDK versions 1.0.0-1.1.4 allows anonymous network clients to invoke protected methods, read role-permission metadata, and delete protected nodes. The defect is a missing field copy in OpcUaServerConfig.copy(): when servers construct their running configuration via this method, the configured RoleMapper is silently dropped, causing the DefaultAccessController to receive empty role ID lists for every session and skip all role-permission enforcement. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Technical ContextAI

Eclipse Milo (CPE: cpe:2.3:a:eclipse_foundation:eclipse_milo) is an open-source Java SDK for the OPC Unified Architecture (OPC UA) protocol, commonly used in industrial IoT, SCADA, and process-control systems. OPC UA provides a role-based access control model where a RoleMapper translates authenticated session identities into OPC UA role IDs, and an AccessController enforces permissions on nodes and methods against those roles. The root cause (CWE-862, Missing Authorization) is a one-line omission in the OpcUaServerConfig.copy() static builder method: the method reconstructed all other configuration fields but did not call config.getRoleMapper().ifPresent(builder::setRoleMapper). Consequently, any server whose running config flows through copy() - a common pattern for deriving a live config from a template - silently loses its RoleMapper. With no mapper, getRoleIds() returns empty, and the DefaultAccessController skips role-permission checks entirely, treating every session as if it had no role assignments. The commit at https://github.com/eclipse-milo/milo/commit/d51f03e9a75f313ab41c3d68d809f4b922073f1a confirms both the defect and its single-line fix.

RemediationAI

Apply the upstream fix by upgrading to a version of Eclipse Milo that incorporates commit d51f03e9a75f313ab41c3d68d809f4b922073f1a (https://github.com/eclipse-milo/milo/commit/d51f03e9a75f313ab41c3d68d809f4b922073f1a); monitor the Eclipse Milo GitHub releases page and the Eclipse security advisory at https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/598 for a formal patched release version, which has not been confirmed in available references. As an immediate compensating control, audit all server initialization code for use of OpcUaServerConfig.copy() and replace affected instances with direct builder construction that explicitly calls .setRoleMapper(...) - this eliminates the defect without waiting for a release. Additionally, disable anonymous session support on any OPC UA server that does not operationally require it by configuring the IdentityValidator to reject anonymous identities; this removes the attack surface entirely and has no impact on deployments using certificate or username authentication.