LDAP injection in OPNsense - CVE-2026-34578

Detailed vulnerability description

The vulnerability allows a remote attacker to disclose sensitive information and bypass group-based access restrictions.

The vulnerability exists due to improper neutralization of special elements used in an LDAP query in the LDAP authentication connector searchUsers() method when processing the username field supplied to the WebGUI login page. A remote attacker can inject LDAP filter metacharacters into the username field to disclose sensitive information and bypass group-based access restrictions.

Enumeration can be performed without credentials, while bypassing the extended query group restriction requires knowledge of a valid LDAP user's password and only applies when an Extended Query is configured to restrict logins by group membership.

How to mitigate CVE-2026-34578

Sources

• https://github.com/opnsense/core/security/advisories/GHSA-jpm7-f59c-mp54
• https://github.com/advisories/GHSA-jpm7-f59c-mp54