Configuration Injection Vulnerability in OPNsense Core by Deciso

CVE-2026-119560

What is CVE-2026-119560?

The OPNsense Core, up to version 26.7.8, is susceptible to a configuration injection vulnerability that affects the ntpd service. Authenticated users who have access to specific privileges can exploit this flaw by transmitting CR/LF characters through the fudge and refid fields within the ntpd configuration. This process permits the insertion of arbitrary directives into the ntpd.conf file, which is executed by the ntpd daemon running with root permissions. Such exploitation could potentially allow unauthorized actions on the system, highlighting the urgency for users to review and apply available security updates. For detailed technical insights, you can refer to the GitHub Security Advisory and other related resources.

References