CVE-2026-58080

Description

In Eclipse Milo versions 1.0.0 through 1.1.4, `OpcUaServerConfig.copy()` fails to preserve a configured `RoleMapper`. On servers that rely on role permissions and construct the running configuration through `copy()`, sessions receive no role IDs and the default access controller skips role-permission checks, allowing an anonymous client where anonymous sessions are permitted to read role-permission metadata, invoke protected methods, or delete protected nodes.

Overview

State: PUBLISHED
Assigner (CNA): eclipse
CVSS severity: HIGH
CVSS score: 8.8 / 10
CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
Effective score: 8.8 / 10 HIGH source: CNA overview
CWE(s): CWE-862
Reserved: 2026-07-16
Published: 2026-08-04 12:05 UTC
Last updated: 2026-08-04 15:02 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/58xxx/CVE-2026-58080.json
Linked Threat: CVE-2026-58080 — CVE-2026-58080

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-52663

EUVD enrichment is queued; refresh the page in a few seconds.

Affected products (1)

Vendor	Product	Versions	Platforms
Eclipse Foundation	Eclipse Milo	`1.0.0` (affected)	—

Vendor references (3)

References embedded in the original CVE record by the assigning CNA.

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

Remediations (10)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

[Updates] Patch Notes Version 1.15.00 | Crimson Desert

web:crimsondesert.pearlabyss.com

Fellow Greymanes, Here are the fixes and improvements that have been added this patch . Major UpdatesThis patch adds various bug fixes and stability improvements. Update ScheduleThe patch is rolling out across all platforms. Please refer to the Update section below to see the state of the patch ...

2026-08-06 01:16 UTC
Palm Springs Local News - Patch

web:patch.com

Palm Springs Latest Headlines: In-N-Out Mass Shooting Victim From SoCal: 'He Helped Hundreds Of People'; Fire Destroys 2 Homes In Desert Hot Springs; 7 Capital Gains Mistakes Seniors Should Look ...

2026-08-06 01:16 UTC
Patch - patch

web:patchnashville.com

Patch was born out of a love of children's fashion and classic yet modern gifting. The goal was to create a timeless yet modern boutique with a playful touch featuring children's clothing, gifts, & accessories.

2026-08-06 01:16 UTC
Security Update Guide - Microsoft Security Response Center

web:portal.msrc.microsoft.com

The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.

2026-08-06 01:16 UTC
N-central 2026.3 Hotfix 1 - Mitigation for CVE-2026-18577

web:status.n-able.com

If you identify any of these, contact N-able support immediately and engage your own security team. Supported Upgrade Paths Upgrade directly to 2026.3.1 from 2025.4 2026.1 2026.2 2026.3 If you are on an older version, we recommend going to any of the builds above. Then upgrade to this Hotfix version ASAP. If you are unsure of what to do, you can contact support directly. Do I need to update my ...

2026-08-06 01:16 UTC
Halo Campaign Evolved Patch Notes - July 29, 2026

web:support.halowaypoint.com

July 29 Patch Overview This update to Halo: Campaign Evolved brings enhanced stability across multiple platforms, adjustments to multiple enemy AI behaviors, and more.

2026-08-06 01:16 UTC
N-central Security Update - August 4, 2026 - N-able

web:www.n-able.com

As our investigation progressed, we determined the vulnerability affected all versions of N‑central and released a comprehensive hotfix (2026.3.1.7) on August 2: N‑central 2026.3 Hotfix 1 - Mitigation for CVE - 2026 -18577.

2026-08-06 01:16 UTC
Oracle Critical Patch Update Advisory - April 2026

web:www.oracle.com

Oracle Critical Patch Update Advisory - April 2026 Description A Critical Patch Update is a collection of patches for multiple security vulnerabilities. These patches address vulnerabilities in Oracle code and in third party components included in Oracle products. These patches are usually cumulative, but each advisory describes only the security patches added since the previous Critical Patch ...

2026-08-06 01:16 UTC
patch.moe - Age Verification

web:www.patch.moe

Age Verification Are you 18 years or older? YES NO

2026-08-06 01:16 UTC
Rom Patcher JS

web:www.romhacking.net

An online web-based ROM patcher. Supported formats: IPS, BPS, UPS, APS, RUP, PPF and xdelta.

2026-08-06 01:16 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-58080.json.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-58080",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-04T14:28:17.093154Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-04T15:02:18.894Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Eclipse Milo",
          "vendor": "Eclipse Foundation",
          "versions": [
            {
              "lessThan": "1.1.5",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Abhinav Agarwal (GitHub: @abhinavagarwal07)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "<p>In Eclipse Milo versions 1.0.0 through 1.1.4, `OpcUaServerConfig.copy()` fails to preserve a configured `RoleMapper`. On servers that rely on role permissions and construct the running configuration through `copy()`, sessions receive no role IDs and the default access controller skips role-permission checks, allowing an anonymous client where anonymous sessions are permitted to read role-permission metadata, invoke protected methods, or delete protected nodes.</p>"
            }
          ],
          "value": "In Eclipse Milo versions 1.0.0 through 1.1.4, `OpcUaServerConfig.copy()` fails to preserve a configured `RoleMapper`. On servers that rely on role permissions and construct the running configuration through `copy()`, sessions receive no role IDs and the default access controller skips role-permission checks, allowing an anonymous client where anonymous sessions are permitted to read role-permission metadata, invoke protected methods, or delete protected nodes."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-122",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-122"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-04T12:05:10.547Z",
        "orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
        "shortName": "eclipse"
      },
      "references": [
        {
          "url": "https://github.com/eclipse-milo/milo/commit/d51f03e9a75f313ab41c3d68d809f4b922073f1a"
        },
        {
          "url": "https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/598"
        },
        {
          "url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/180"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
    "assignerShortName": "eclipse",
    "cveId": "CVE-2026-58080",
    "datePublished": "2026-08-04T12:05:10.547Z",
    "dateReserved": "2026-07-16T13:58:02.234Z",
    "dateUpdated": "2026-08-04T15:02:18.894Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}