core

OPNsense GUI and system management The OPNsense project invites developers to start contributing to the code base. For your own purposes or – even better – to join us in creating the best open source firewall available. The build process has been designed to make it easy for anyone to build and...

CVE-2026-119560

OPNsense core versions through 26.7.8 are vulnerable to a configuration injection flaw due to improper neutralization of CRLF sequences (CWE-93). Authenticated users with page-services-ntp-gps or PPS privileges can submit CR/LF characters via services_ntpd_gps.php or services_ntpd_pps.php. This a...

CVE-2026-119560 OPNsense core through 26.7.8 NTP Configuration Injection via GPS and PPS Fudge Fields

OPNsense core through 26.7.8 contains a configuration injection vulnerability that allows authenticated users to append ntpd.conf directives by embedding newlines in the fudge and refid fields. Attackers holding the page-services-ntp-gps or PPS privilege can submit CR/LF characters via...

CVE-2026-119423

OPNsense core versions prior to 26.7.8 are vulnerable to a log injection vulnerability (CWE-117). This flaw allows unauthenticated attackers to plant arbitrary victim IP addresses into the lockout_handler by submitting crafted usernames during WebGUI login attempts. By repeatedly submitting usern...

CVE-2026-119423 OPNsense core before 26.7.8 Lockout IP Planting via WebGUI Login Username

OPNsense core before 26.7.8 contains a log injection vulnerability that allows unauthenticated attackers to plant victim IP addresses in the lockouthandler by submitting crafted WebGUI login usernames. Attackers can submit usernames like 'Invalid user ' repeatedly to add the victim to the...

opnsense-ntp-gps-fudge

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · opnsense-ntp-gps-fudge Write-up: https://abraxaslabs.tech/research/opnsense-ntp-gps-fudge opnsense-ntp-gps-fudge Class: Config line injection Reach: Remote OPNsense core 26.7.6 a842fe48 - opnsense.org Leftover of...

opnsense-uidfield-system-uid0

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · opnsense-uidfield-system-uid0 Write-up: https://abraxaslabs.tech/research/opnsense-uidfield-system-uid0 opnsense-uidfield-system-uid0 Class: Privilege leftover Reach: Remote OPNsense core 26.7.6 a842fe48 - opnsense.or...

opnsense-lockout-factory-ip

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · opnsense-lockout-factory-ip Write-up: https://abraxaslabs.tech/research/opnsense-lockout-factory-ip opnsense-lockout-factory-ip Class: Privilege leftover Reach: Remote OPNsense core 26.7.6 a842fe48 - opnsense.org Unau...

opnsense-captive-lastseen-roam

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · opnsense-captive-lastseen-roam Write-up: https://abraxaslabs.tech/research/opnsense-captive-lastseen-roam opnsense-captive-lastseen-roam Class: Network-access bypass Reach: Remote OPNsense core 26.7.6 a842fe48 -...

opnsense-wlan-wpa-line

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · opnsense-wlan-wpa-line Write-up: https://abraxaslabs.tech/research/opnsense-wlan-wpa-line opnsense-wlan-wpa-line Class: Config line injection Reach: Remote OPNsense core 26.7.6 a842fe48 - opnsense.org Leftover of...

CVE-2026-71490

In versions of OPNsense prior to 26.1.11 , a flaw in OPNsense\Core\ACL::hasPrivilege() allows users to bypass MVC read-only write protection . The root cause is that directly assigned comma-separated values are appended as a single string and evaluated using an exact comparison when checking use...

CVE-2026-71490 OPNsense: Direct comma-separated user privileges bypass OPNsense MVC read-only write protection

OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11, OPNsense\Core\ACL::hasPrivilege appends a directly assigned comma-separated value as one string and then uses an exact comparison when checking user-config-readonly. A user directly assigned both a component write...

CVE-2026-30868 Cross-Site Request Forgery (CSRF) in opnsense/core

OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.4, multiple OPNsense MVC API endpoints perform state‑changing operations but are accessible via HTTP GET requests without CSRF protection. The framework CSRF validation in ApiControllerBase only applies to POST/PUT/DELETE...