CVE-2026-119424 in OPNsense
Summary
by MITRE • 10/30/2026
OPNsense core before 26.7.8 contains a configuration line injection vulnerability that allows authenticated users with wireless-edit privilege to inject directives by embedding CR/LF characters in WPA fields. Attackers can place newlines in wpa.identity, wpa.passphrase, or RADIUS shared secrets to append arbitrary wpa_supplicant or hostapd directives loaded by root-run daemons.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified in OPNsense core versions prior to 26.7.8 represents a critical configuration injection flaw within the wireless network management subsystem. This security issue specifically targets authenticated users who possess the privilege to edit wireless configurations, allowing them to manipulate underlying system daemon settings through improper input validation. The root cause of this weakness lies in the handling of WPA (Wi-Fi Protected Access) related fields during the processing of configuration files for wpa_supplicant and hostapd services. These daemons are responsible for managing Wi-Fi authentication and access control, operating with elevated privileges to ensure secure network connectivity. When a user submits wireless credentials or identity information, the system fails to adequately sanitize special characters, specifically carriage return (CR) and line feed (LF) sequences, before writing them into configuration templates.
This lack of sanitization enables an attacker to perform a configuration line injection attack by embedding newline characters within sensitive input fields such as wpa.identity, wpa.passphrase, or RADIUS shared secrets. By injecting these control characters, the attacker can break out of the intended string context and append arbitrary directives directly into the configuration files that are subsequently loaded by root-run daemons. This technique effectively bypasses standard access controls because the injected commands are executed with the high-level privileges of the daemon process rather than as a regular user operation. The vulnerability exploits the trust placed in these input fields, assuming they will only contain alphanumeric characters or safe symbols, thereby allowing an attacker to introduce malicious configuration lines that alter network behavior or expose sensitive data.
The operational impact of this vulnerability is severe due to the potential for remote code execution and privilege escalation within the context of the system's networking stack. An authenticated user with wireless-edit privileges can manipulate how wpa_supplicant or hostapd behave, potentially leading to unauthorized access to protected networks, interception of encrypted traffic, or disruption of network services. Furthermore, if the injected directives allow for command execution through specific daemon features or misconfigurations that expose shell commands, it could lead to full system compromise. The ability to modify RADIUS shared secrets also poses a significant risk, as these are critical for authenticating against external authentication servers; compromising them can undermine the integrity of centralized identity management and allow attackers to impersonate legitimate users during authentication processes.
From a classification perspective, this vulnerability aligns with CWE-94 Improper Control of Generation of Code (Code Injection), specifically where user input is directly incorporated into code or configuration files without proper validation. It also relates to CWE-78 OS Command Injection if the injected directives result in shell command execution through daemon features. In terms of adversary tactics, this aligns with MITRE ATT&CK techniques related to Persistence and Privilege Escalation via system service manipulation, as well as Defense Evasion by modifying configuration files to bypass security controls. The attack vector is classified as local or network-adjacent depending on the deployment model, requiring initial authentication but leveraging a high-level privilege for exploitation.
To mitigate this vulnerability, administrators must immediately upgrade OPNsense core to version 26.7.8 or later, where input validation and sanitization mechanisms have been strengthened to prevent newline injection in WPA fields. Until an update is applied, it is advisable to restrict wireless-edit privileges to only those users who absolutely require them, minimizing the attack surface for potential exploitation. Additionally, implementing strict input filtering at the application layer that rejects or escapes special characters like CR and LF in all configuration inputs can provide a temporary defense-in-depth measure. Regular auditing of configuration files and monitoring for unusual daemon behavior can also help detect any attempted exploitation activities before they result in significant system compromise.