CVE-2026-53582
7.1HighPublished 15 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-91, CWE-643
Impact
Authenticated users with CA or Certificate Manager privileges can extract sensitive data from config.xml, including password hashes, API keys, and VPN private keys. They achieve this via an XPath injection side-channel oracle to escalate privileges across the firewall.
Root cause
The Trust module directly interpolates user-controlled CA and certificate refid values into raw XPath expressions without sanitization.
Affected systems
OPNsense prior to version 26.1.10
CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:L
Fix & remediation
Upgrade OPNsense to version 26.1.10 or later. If updating immediately is not possible, restrict or revoke CA Manager and Certificate Manager permissions from non-admin accounts.
$ opnsense-updateAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.10, the Trust module stores attacker-controlled certificate authority and certificate refid values and interpolates them into XPath expressions in src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CAsField.php and src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CertificatesField.php. A user with CA Manager or Certificate Manager privileges can submit a crafted refid and repeatedly retrieve the object to obtain a boolean refcount oracle, allowing values in config.xml to be recovered character by character. Exposed values can include password hashes, API credentials, certificate private keys, VPN key material, and high-availability credentials, enabling privilege escalation and compromise of other security domains. This issue is fixed in version 26.1.10.