Read the docs
TI-2026-74825 Aliases CVE-2026-58395

XPath injection in OPNsense MVC safe-delete exposes configuration data

Priority MEDIUM 53CWE-643Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

OPNsense core is affected before version 26.1.11. The safe-delete path in ApiMutableModelControllerBase::delBase() inserts an unvalidated token from the request URL into an XPath expression over config.xml, a flaw classified as CWE-643. A user with any one affected module privilege can send a crafted token to one of 21 delete endpoints and receive an error response that exposes configuration item names, descriptions, reference paths and UUIDs, including for modules the user cannot otherwise access. The request does not modify configuration or delete anything.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the safe-delete path reached through ApiMutableModelControllerBase::delBase() interpolates an unvalidated safe-delete token from the request URL into an XPath expression over config.xml before confirming that the token is a valid identifier. A user holding any one affected module privilege can send a crafted token to one of 21 affected delete endpoints covering Traffic Shaper, DHCP relay, Dnsmasq, Firewall Category, or Kea DHCP, causing the XPath to match configuration data across modules. The resulting error response exposes configuration item names, descriptions, reference paths, and UUIDs and provides an XPath substring-presence oracle, including for modules the user cannot otherwise access. The request does not modify configuration or perform a deletion. This issue is fixed in version 26.1.11.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00357 29th percentileScored 2026-11-07
Fix Fixed core (opnsense): 26.1.11

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
opnsensecorebefore 26.1.1126.1.11Patch availableCNA
  • core Vendoropnsense Affected before 26.1.11 Fixed in 26.1.11 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:opnsense:opnsense:*:*:*:*:*:*:*:*——opnsense
  • cpe:2.3:a:opnsense:opnsense:*:*:*:*:*:*:*:* Versions — — ·opnsense

Remediation

Update OPNsense core to version 26.1.11 or later, which fixes this issue. The sources list no fixed version for OPNsense core beyond 26.1.11.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA core (opnsense) Fixed in 26.1.11

Timeline

  1. 2026-10-16 Threatist record created from CVE-2026-58395

References

Other 4

  • TI-2023-20247 A command injection vulnerability in the component /api/cron/settings/setJob/ of OPNsense… CVSS 3.1CRITICAL 9.8
  • TI-2023-20243 Insecure permissions in the configuration directory (/conf/) of OPNsense Community… CVSS 3.1CRITICAL 9.8
  • TI-2023-20240 A command injection vulnerability in the component diag_backup.php of OPNsense Community… CVSS 3.1CRITICAL 9.8
  • TI-2023-11947 DECISO OPNsense 23.1 does not impose rate limits for authentication, allowing attackers… CVSS 3.1CRITICAL 9.8
  • TI-2026-74819 Path traversal in OPNsense GeoIP importer allows root code execution CVSS 3.1CRITICAL 9.9
  • TI-2023-20246 /ui/cron/item/open in the Cron component of OPNsense Community Edition before 23.7 and… CVSS 3.1CRITICAL 9.6
See all 54 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences