Log Injection Vulnerability in OPNsense Core by Deciso
CVE-2026-119423

6.9MEDIUM

Key Information:

Vendor

Opnsense

Status
Core
Vendor
CVE Published:
30 October 2026

What is CVE-2026-119423?

The OPNsense Core software prior to version 26.7.8 is susceptible to a log injection vulnerability. This issue enables unauthenticated attackers to exploit crafted login usernames within the WebGUI, allowing them to manipulate the sshlockout table. By repeatedly submitting usernames that include victim IPs, attackers can inadvertently add legitimate users to the lockout mechanism, leading to disruption of SSH and WebGUI access. This flaw not only compromises the availability of services for affected users but also risks the integrity of system logging, severely impacting operational security.

Affected Version(s)

core 0 < 26.7.8

References

https://github.com/opnsense/core/commit/14f8f7dd1d5f06522...
patch
https://github.com/opnsense/core/commit/2076f2c195bf9537e...
patch
https://github.com/opnsense/core/blob/26.7.7/src/opnsense...
technical-description

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abraxas Labs
Ad Schellevis
.