CVE-2026-58080 is a high severity authorization flaw in Eclipse Milo, the Java OPC UA SDK. OpcUaServerConfig.copy() fails to keep a configured RoleMapper, so role permission checks are skipped for anonymous sessions. Versions 1.0.0 through 1.1.4 are affected. Upgrade to a release after 1.1.4.
What's affected
- Product: Eclipse Milo, versions 1.0.0 through 1.1.4.
- Fixed: a release after 1.1.4. The Eclipse CVE assignment request lists the affected range as 1.0.0 up to but not including 1.1.5, so 1.1.5 should be the first fixed release. Confirm in the Milo release notes.
- Exposed servers: those that rely on role permissions, build their running configuration through
copy(), and allow anonymous sessions.
How to check if you're exposed
Find the Milo version your build resolves.
mvn dependency:tree -Dincludes=org.eclipse.milo
./gradlew dependencies --configuration runtimeClasspath | grep -i milo
Compare it with the affected range above, and look at transitive use as well: Milo is often embedded in industrial gateways and data collection products that do not list it prominently.
Then look at your server setup. Search your code for OpcUaServerConfig and for calls to copy. If the configuration you start the server with came from a copy of a config that had a RoleMapper, the mapper was dropped. Finally, check whether anonymous identity tokens are enabled on the endpoint.
What to do now
- Upgrade Eclipse Milo to a release after 1.1.4, and check the release notes for the fixed version.
- Disable anonymous sessions on servers that do not need them.
- If you cannot upgrade, set the role mapper again on the final configuration after any copy.
- Test your server with an anonymous client and confirm that protected methods and nodes are denied.
- Review your OPC UA endpoint exposure. Industrial servers should not be reachable from the internet.
- Run the free in-browser dependency scan on your lockfile or manifest to see every affected package in one pass.
Why it matters
The weakness is CWE-862 (Missing Authorization). The fix commit says it keeps copied server configurations authorization equivalent to their originals. Without the mapper, sessions receive no role identifiers, and the default access controller then skips role permission checks.
The consequence in the record is that an anonymous client can read role permission metadata, call protected methods or delete protected nodes. On an industrial system, that is control over process data. The record scores it 8.2 (High). The Eclipse CVE assignment request, which is the project's own filing, gives 8.8 under CVSS 4.0, so the sources differ on the number. The record does not mark it as exploited in the wild.
Quick check
Is my server affected if it never calls copy()?
Per the record, the flaw is in how a copied configuration loses its role mapper. A server built without the copy path keeps its mapper, but check how your configuration is assembled before relying on that.
Sources
Last reviewed: 18 October 2026.
