Remote Code Execution Vulnerability in OPNsense Firewall by Deciphering Configuration Data

CVE-2026-53582

What is CVE-2026-53582?

The OPNsense Firewall is susceptible to a security flaw involving the Trust module that improperly processes attacker-controlled inputs. This vulnerability allows users with CA Manager or Certificate Manager privileges to exploit crafted identifier values, enabling them to extract sensitive information from the configuration file. This includes critical data such as password hashes, API credentials, VPN keys, and certificate private keys, significantly increasing the risk of privilege escalation and compromising other security domains. The issue has been rectified in version 26.1.10.

References