Read the docs
TI-2026-83002 Aliases CVE-2026-119423GHSA-m68j-m67p-c39j

Log injection in OPNsense lets attackers lock out victim IP addresses

Priority LOW 37CWE-117Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

OPNsense core before 26.7.8 contains a log injection flaw (CWE-117) in its WebGUI login handling. An unauthenticated remote attacker can submit crafted login usernames that place a victim's IP address into the lockout handler's sshlockout table. The victim is then blocked from SSH and WebGUI access, and its pf states are killed.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

OPNsense core before 26.7.8 contains a log injection vulnerability that allows unauthenticated attackers to plant victim IP addresses in the lockout_handler by submitting crafted WebGUI login usernames. Attackers can submit usernames like 'Invalid user <victim-ip>' repeatedly to add the victim to the sshlockout table, blocking SSH and WebGUI access and killing its pf states.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00376 31st percentileScored 2026-11-07
Fix Fixed core (opnsense): 26.7.8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
opnsensecorebefore 26.7.826.7.8Patch availableCNA
  • core Vendoropnsense Affected before 26.7.8 Fixed in 26.7.8 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:opnsense:opnsense:*:*:*:*:*:*:*:*——opnsense
  • cpe:2.3:a:opnsense:opnsense:*:*:*:*:*:*:*:* Versions — — ·opnsense

Remediation

Upgrade OPNsense core to version 26.7.8.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

  • Fix · CNA core (opnsense) Fixed in 26.7.8

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    opnsense core 26.7.8

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-82992 Command injection in OPNsense firmware mirror setting allows root accessPriority MEDIUM 44
    • TI-2026-83003 Configuration line injection in OPNsense wireless WPA settingsPriority LOW 30
    Show all 3 records →

Timeline

  1. 2026-10-30 Threatist record created from CVE-2026-119423
  2. 2026-10-30 Alias added: GHSA-m68j-m67p-c39j
  3. 2026-11-01 Priority changed: MEDIUM → LOW
  4. 2026-11-04 CISA SSVC decision points changed

References

Patch 2

Advisory 2

Other 3

  • TI-2023-20247 A command injection vulnerability in the component /api/cron/settings/setJob/ of OPNsense… CVSS 3.1CRITICAL 9.8
  • TI-2023-20243 Insecure permissions in the configuration directory (/conf/) of OPNsense Community… CVSS 3.1CRITICAL 9.8
  • TI-2023-20240 A command injection vulnerability in the component diag_backup.php of OPNsense Community… CVSS 3.1CRITICAL 9.8
  • TI-2023-11947 DECISO OPNsense 23.1 does not impose rate limits for authentication, allowing attackers… CVSS 3.1CRITICAL 9.8
  • TI-2026-74819 Path traversal in OPNsense GeoIP importer allows root code execution CVSS 3.1CRITICAL 9.9
  • TI-2023-20246 /ui/cron/item/open in the Cron component of OPNsense Community Edition before 23.7 and… CVSS 3.1CRITICAL 9.6
See all 54 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences