CVE-2026-58080

CVE-2026-58080 represents a silent security regression in Eclipse Milo where the copy() method on OpcUaServerConfig drops the RoleMapper, causing role-based access controls to fail at runtime without any error or warning. The critical danger is the silent failure mode. When copy() is used to construct runtime configuration, it returns a seemingly valid object that passes null checks—your server starts, sessions initialize, and everything appears functional. Only through security review or incident response do you discover that RoleMapper was never wired, and every authenticated user effectively has unrestricted access despite your security configuration. This vulnerability triggers only when two conditions intersect: your server uses role-based permissions (not the default deny-all or permit-all policies), and your configuration construction uses copy() rather than direct instantiation or builders. If you're using role permissions, audit your configuration initialization code now—search for .copy() calls on OpcUaServerConfig or its builder. The broader pattern matters: configuration copy operations across ecosystems have a documented history of silently dropping security-critical state. After patching this specific instance, treat copy() and clone() methods on configuration objects as suspect until proven otherwise. The fix for this CVE addresses RoleMapper, but history suggests RolePermissions and TrustChecker are candidates for similar review. Immediate actions: scan your codebase for OpcUaServerConfig.copy() usage, verify any role-permission servers are initialized via builders or direct instantiation rather than copy(), and monitor for any configuration paths that may have been working but were silently insecure.

Reviewed through automated stages and approved by a human before publication.