CVE-2026-58395 in OPNsense
Summary
by MITRE • 10/15/2026
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the safe-delete path reached through ApiMutableModelControllerBase::delBase() interpolates an unvalidated safe-delete token from the request URL into an XPath expression over config.xml before confirming that the token is a valid identifier. A user holding any one affected module privilege can send a crafted token to one of 21 affected delete endpoints covering Traffic Shaper, DHCP relay, Dnsmasq, Firewall Category, or Kea DHCP, causing the XPath to match configuration data across modules. The resulting error response exposes configuration item names, descriptions, reference paths, and UUIDs and provides an XPath substring-presence oracle, including for modules the user cannot otherwise access. The request does not modify configuration or perform a deletion. This issue is fixed in version 26.1.11.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/15/2026
OPNsense serves as a robust FreeBSD-based firewall and routing platform widely deployed in enterprise and home network environments to manage traffic, security policies, and DHCP services. A critical information disclosure vulnerability exists within the web interface's API layer prior version 26.1.11, specifically affecting the safe-delete mechanism implemented through the ApiMutableModelControllerBase::delBase() function. This architectural flaw stems from an improper validation of user-supplied input before its use in a security-critical operation. The system relies on a token-based approach to ensure that delete operations are authorized and refer to valid configuration objects, intending to prevent unauthorized modifications or deletions by verifying the integrity of the request against stored identifiers.
The technical flaw arises because the safe-delete token extracted from the URL is interpolated directly into an XPath expression used to query the config.xml file before any confirmation step validates whether that token corresponds to a legitimate identifier within the user's authorized scope. This sequence error means that even if a user lacks permission for certain modules, they can manipulate this token to craft malicious XPath queries. By sending crafted tokens to one of twenty-one affected endpoints covering components such as Traffic Shaper, DHCP relay, Dnsmasq, Firewall Category, or Kea DHCP, an attacker can force the system to evaluate expressions against configuration data outside their permitted access boundaries. The vulnerability does not allow for arbitrary code execution or direct modification of the configuration; rather, it exploits the error handling and response generation logic inherent in XPath processing failures.
The operational impact of this vulnerability is significant information disclosure. When a crafted token results in an invalid or unexpected match within the XML structure, the system returns an error response that inadvertently leaks sensitive internal details. These responses expose configuration item names, descriptions, reference paths, and universally unique identifiers (UUIDs). Furthermore, because XPath errors can be manipulated to reveal whether specific substrings are present in the underlying data, this vulnerability effectively provides a substring-presence oracle. This allows attackers to perform blind information gathering, potentially reconstructing parts of the system's configuration or identifying valid objects within modules they do not have direct access to via standard UI navigation. Such leakage aids adversaries in mapping network infrastructure and planning further attacks against more critical components.
From a classification perspective, this vulnerability aligns with CWE-209, which describes the generation of an error message that includes sensitive information, as well as CWE-611, referring to Improper Restriction of XML External Entity Reference or improper validation in XML processing contexts where input is not sanitized before use. In terms of adversary tactics, this behavior corresponds to ATT&CK technique T1087, specifically the enumeration of local accounts and system configuration data through API abuse. The attacker leverages authenticated access with minimal privileges to extract high-value intelligence about the network's internal state without triggering typical intrusion detection alerts associated with destructive actions like deletion or modification.
Mitigation for this issue requires immediate upgrading OPNsense to version 26.1.11 or later, where the validation logic has been corrected to ensure that token validity is confirmed before any XPath interpolation occurs. Until an upgrade can be performed in environments where patching is delayed, administrators should consider restricting access to the affected API endpoints through network-level firewall rules if those services are exposed externally. Additionally, ensuring that error handling mechanisms do not return detailed stack traces or XML parsing errors to end-users can help mitigate the severity of information leakage for any remaining unpatched instances in legacy systems. Regular auditing of user privileges and minimizing the number of modules with API access also reduces the attack surface available to potential exploiters holding low-level permissions.