Line Injection Vulnerability in OPNsense Firewall and Routing Platform
CVE-2026-57154

8.1HIGH

Key Information:

Vendor

Opnsense

Status
Core
Vendor
CVE Published:
3 November 2026

What is CVE-2026-57154?

The OPNsense firewall and routing platform has a vulnerability that allows authenticated Web UI or API users with delegated access to craft input containing CR or LF characters in fields meant for single-line input. This can lead to the generation of privileged service configuration files containing additional attacker-controlled commands or policies. Particularly concerning paths include Dnsmasq configurations impacting DHCP and DNS behaviors. Fields affected also include OpenVPN, DHCPv6, and various system functionalities. The flaw can allow service behavior to diverge from intended configurations and may lead to a denial of service, unauthorized access, or command execution in some instances. Users are advised to update to versions 26.1.11 or 26.4.1p1 to mitigate this risk.

Affected Version(s)

core < 26.1.11

References

https://github.com/opnsense/core/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/opnsense/core/commit/52b18e67a9ec4596a...
x_refsource_MISC
https://github.com/opnsense/core/commit/6c3be9a11699879fe...
x_refsource_MISC

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.