CVE-2026-53582
Received Received - Intake

XPath Injection in OPNsense Trust Module

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.10, the Trust module stores attacker-controlled certificate authority and certificate refid values and interpolates them into XPath expressions in src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CAsField.php and src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CertificatesField.php. A user with CA Manager or Certificate Manager privileges can submit a crafted refid and repeatedly retrieve the object to obtain a boolean refcount oracle, allowing values in config.xml to be recovered character by character. Exposed values can include password hashes, API credentials, certificate private keys, VPN key material, and high-availability credentials, enabling privilege escalation and compromise of other security domains. This issue is fixed in version 26.1.10.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-53582
EUVD
EUVD-2026-102112

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
opnsense core < 26.1.10

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-91 The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.
CWE-643 The product uses external input to dynamically construct an XPath expression used to retrieve data from an XML database, but it does not neutralize or incorrectly neutralizes that input. This allows an attacker to control the structure of the query.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-53582 is a stored XPath injection vulnerability in OPNsense affecting versions up to 26.1 and 26.4. The flaw exists in the trust module where the refid field of a CA object is unsanitized, allowing arbitrary XPath syntax injection. An attacker with System: CA Manager permissions can exploit this to leak secrets from config.xml character by character using a boolean side channel.

Detection Guidance

To detect this vulnerability, check if your OPNsense version is below 26.1.10. Exploitation involves sending crafted POST requests to the /api/trust/ca/add endpoint with XPath injection payloads in the refid parameter, then retrieving data via GET requests to observe response differences. Automated tools can simulate this attack to test for vulnerability.

Impact Analysis

This vulnerability allows an attacker to extract sensitive data such as password hashes, API credentials, certificate private keys, VPN key material, and high-availability credentials. It can lead to privilege escalation and compromise of other security domains. Exploitation requires only low privileges and can be automated with around 400 requests to extract a password hash.

Mitigation Strategies

Immediately upgrade OPNsense to version 26.1.10 or later. As a temporary measure, add input validation to restrict refid to alphanumeric characters using a regex pattern like /^[0-9a-f]{13}$/. Modify the Ca.xml and Cert.xml files to enforce this validation in the XML configuration.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53582. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart