CVE-2026-119423
Received Received - Intake

OPNsense Core Log Injection in WebGUI Login

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: VulnCheck

Description
OPNsense core before 26.7.8 contains a log injection vulnerability that allows unauthenticated attackers to plant victim IP addresses in the lockout_handler by submitting crafted WebGUI login usernames. Attackers can submit usernames like 'Invalid user <victim-ip>' repeatedly to add the victim to the sshlockout table, blocking SSH and WebGUI access and killing its pf states.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-119423
EUVD
EUVD-2026-113803

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
opnsense core 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-117 The product constructs a log message from external input, but it does not neutralize or incorrectly neutralizes special elements when the message is written to a log file.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

OPNsense core before version 26.7.8 has a log injection flaw. Unauthenticated attackers can inject crafted usernames like 'Invalid user <victim-ip>' into the WebGUI login system. This manipulates logs to add the victim's IP to the sshlockout table, blocking SSH and WebGUI access and terminating pf states.

Detection Guidance

Check OPNsense logs for repeated failed login attempts with crafted usernames containing IP addresses. Inspect the sshlockout table for unauthorized entries using the command 'pfctl -t sshlockout -T show'.

Impact Analysis

An attacker could block your SSH and WebGUI access by injecting your IP into the lockout table. This would prevent legitimate access to your OPNsense device and disrupt network management. Additionally, active network connections may be terminated due to pf state killing.

Mitigation Strategies

Upgrade OPNsense core to version 26.7.8 or later. Review and clear the sshlockout table with 'pfctl -t sshlockout -T flush'. Monitor logs for suspicious login patterns.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119423. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart