XPath Injection Vulnerability in OPNsense Firewall and Routing Platform
CVE-2026-58395

4.3MEDIUM

Key Information:

Vendor

Opnsense

Status
Core
Vendor
CVE Published:
15 October 2026

What is CVE-2026-58395?

The OPNsense firewall and routing platform has a vulnerability wherein an unvalidated safe-delete token can be interpolated into an XPath expression via the ApiMutableModelControllerBase::delBase() method. This flaw allows a user with relevant module privileges to send a crafted token to specific delete endpoints related to Traffic Shaper, DHCP relay, Dnsmasq, Firewall Category, or Kea DHCP. The improper validation of the token enables attackers to match configuration data across various modules, potentially exposing sensitive information such as configuration item names, descriptions, reference paths, and UUIDs. This vulnerability does not alter the configuration or perform deletions, but it can lead to exposure of sensitive data, making it critical for users to upgrade to version 26.1.11 to mitigate these risks.

Affected Version(s)

core < 26.1.11

References

https://github.com/opnsense/core/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/opnsense/core/commit/631e14721b311badc...
x_refsource_MISC
https://github.com/opnsense/core/commit/d7054cef69f72588f...
x_refsource_MISC

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.