SB2026072602 - Multiple vulnerabilities in OPNsense
Published: July 26, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 7 vulnerabilities.
1) Resource exhaustion (CVE-ID: N/A)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in the WebGUI lighttpd listener when buffering request bodies before authentication and CSRF validation. A remote attacker can send one or more large POST requests to cause a denial of service.
The listener accepts request bodies up to 2 GiB and uses temporary files on the root filesystem before passing requests to PHP/FastCGI.
2) Incorrect authorization (CVE-ID: N/A)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to make persistent configuration changes.
The vulnerability exists due to incorrect authorization in API controllers using manual Config::save() paths when handling crafted API requests to affected endpoints. A remote user can send a crafted request to make persistent configuration changes.
Exploitation requires an authenticated account assigned the user-config-readonly deny privilege together with an affected page privilege.
3) Authorization bypass through user-controlled key (CVE-ID: N/A)
CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key
CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose private keys and potentially impersonate clients or services.
The vulnerability exists due to authorization bypass through user-controlled key in OPNsense\OpenVPN\Api\ExportController when handling download requests with a route-supplied certificate reference. A remote user can submit a crafted download request with an unlisted certificate reference to disclose private keys and potentially impersonate clients or services.
The download endpoint does not verify that the requested certificate belongs to the selected server CA, the current user, or any export-visible account row.
4) Cross-site scripting (CVE-ID: N/A)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote user to execute arbitrary script in the victim's browser within the WebGUI origin.
The vulnerability exists due to cross-site scripting in the trust revocation CRL description handling in /ui/trust/crl when rendering a stored CRL description into the CRL edit tab label. A remote user can store a crafted CRL description to execute arbitrary script in the victim's browser within the WebGUI origin.
User interaction is required to open the CRL edit row.
5) Cross-site scripting (CVE-ID: N/A)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote user to execute arbitrary script in the victim's browser within the WebGUI origin.
The vulnerability exists due to cross-site scripting in the firewall live view label rendering in /ui/diagnostics/firewall/log when decoding and rendering a stored firewall rule description from log-derived state. A remote user can store a crafted firewall rule description to execute arbitrary script in the victim's browser within the WebGUI origin.
User interaction is required to open the firewall live view page, and exploitation requires a packet matching the logged rule.
6) Cross-site scripting (CVE-ID: N/A)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote user to execute arbitrary script in the victim's browser within the WebGUI origin.
The vulnerability exists due to cross-site scripting in the dashboard announcements widget when rendering feed-supplied description and link data into HTML. A remote user can control a trusted RSS feed source to execute arbitrary script in the victim's browser within the WebGUI origin.
User interaction is required to open the dashboard with the Announcements widget enabled.
7) Cross-site scripting (CVE-ID: N/A)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote user to execute arbitrary script in the victim's browser within the WebGUI origin.
The vulnerability exists due to cross-site scripting in the IDS rule details view when rendering Suricata rule reference:url metadata as HTML. A remote user can control a trusted or enabled ruleset source to execute arbitrary script in the victim's browser within the WebGUI origin.
User interaction is required to open the installed rule details dialog.
Remediation
Install update from vendor's website.