CVE-2026-119423 in OPNsense
Summary
by MITRE • 10/30/2026
OPNsense core before 26.7.8 contains a log injection vulnerability that allows unauthenticated attackers to plant victim IP addresses in the lockout_handler by submitting crafted WebGUI login usernames. Attackers can submit usernames like 'Invalid user <victim-ip>' repeatedly to add the victim to the sshlockout table, blocking SSH and WebGUI access and killing its pf states.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified within OPNsense core versions prior to 26.7.8 represents a significant security flaw rooted in improper input validation during the authentication process of the web graphical user interface. This log injection vulnerability allows unauthenticated actors to manipulate internal logging mechanisms by submitting specially crafted usernames that contain malicious payloads rather than standard alphanumeric identifiers. The core technical failure lies in the application's handling of these inputs, where it fails to sanitize or escape special characters and structural elements within the username field before processing them for lockout logic. By injecting strings formatted as invalid user attempts targeting specific IP addresses, an attacker can trick the system into treating arbitrary external IPs as legitimate sources of failed login attempts. This manipulation exploits the trust placed in input fields by the underlying security modules responsible for tracking brute-force protection and access control lists.
The operational impact of this vulnerability is severe, primarily manifesting as a denial-of-service condition against targeted network resources. When an attacker submits crafted usernames such as Invalid user followed by a victim's IP address repeatedly to the login handler, the system erroneously records these entries in the sshlockout table. This action effectively blocks SSH and WebGUI access for the specified victim IP because the firewall interprets the injected data as genuine failed authentication attempts from that source. Furthermore, this manipulation results in the termination of existing pf states associated with the targeted IP address, disrupting active network connections and potentially causing service interruptions for legitimate users who rely on stable connectivity to manage or interact with the OPNsense appliance. The ability to remotely trigger these lockouts without any prior authentication makes this a particularly dangerous vector for malicious actors seeking to disrupt administrative access or conduct denial-of-service attacks against critical infrastructure components protected by the firewall.
From an industry standards perspective, this vulnerability aligns closely with CWE-134, which describes the use of externally-controlled format strings that can lead to unexpected behavior when processing input data. Additionally, it relates to CWE-78, involving improper neutralization of special elements used in operating system commands or scripts, as the injected payload influences internal state management logic rather than direct shell execution but still manipulates system configuration through injection techniques. In terms of tactical classification under MITRE ATT&CK, this behavior corresponds to T1496, which covers Resource Hijacking for Denial of Service, specifically focusing on exhausting resources or blocking access to services by manipulating security controls like lockout mechanisms. The exploitation technique also reflects aspects of T1078, Valid Accounts, although in this case it involves forging the appearance of invalid account attempts rather than using valid credentials, thereby abusing the authentication subsystem's defensive features against themselves.
Mitigation strategies for this vulnerability require immediate action to update the OPNsense core software to version 26.7.8 or later, where these input validation flaws have been addressed by developers through rigorous sanitization of username fields and stricter enforcement of expected character sets during login processing. Administrators should also implement network-level access controls such as IP whitelisting for SSH and WebGUI interfaces to limit exposure to untrusted networks. Additionally, deploying intrusion detection systems or web application firewalls that can identify patterns indicative of log injection attempts may provide an additional layer of defense while updates are being applied. Regular auditing of authentication logs and lockout tables is recommended to detect any signs of attempted manipulation, ensuring that the integrity of access control mechanisms remains intact against such adversarial techniques.