CVE-2026-58395
Received Received - Intake

XPath Injection in OPNsense Prior to 26.1.11

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the safe-delete path reached through ApiMutableModelControllerBase::delBase() interpolates an unvalidated safe-delete token from the request URL into an XPath expression over config.xml before confirming that the token is a valid identifier. A user holding any one affected module privilege can send a crafted token to one of 21 affected delete endpoints covering Traffic Shaper, DHCP relay, Dnsmasq, Firewall Category, or Kea DHCP, causing the XPath to match configuration data across modules. The resulting error response exposes configuration item names, descriptions, reference paths, and UUIDs and provides an XPath substring-presence oracle, including for modules the user cannot otherwise access. The request does not modify configuration or perform a deletion. This issue is fixed in version 26.1.11.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-58395
EUVD
EUVD-2026-102116

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
opnsense core < 26.1.11

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-643 The product uses external input to dynamically construct an XPath expression used to retrieve data from an XML database, but it does not neutralize or incorrectly neutralizes that input. This allows an attacker to control the structure of the query.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an XPath injection vulnerability in OPNsense firewall versions 26.1.10 and earlier. Unvalidated delete tokens from URLs are directly inserted into XPath queries without proper validation or escaping. Attackers can craft malicious tokens to manipulate XPath queries, causing them to match unintended nodes in the config.xml file. This leads to error responses that leak sensitive configuration data across all modules, even those the attacker lacks access to.

Detection Guidance

To detect this vulnerability, check if your OPNsense version is prior to 26.1.11. Use the command 'opnsense-version' to verify the installed version. If vulnerable, attempt a crafted request to affected endpoints like /api/dhcpd/relay or /api/firewall/category to observe error responses leaking config data.

Impact Analysis

An attacker with low-privilege access to any affected module can exploit this to view sensitive configuration details like module names, item descriptions, reference paths, and UUIDs across all modules. The attack does not modify or delete data but exposes information that could aid further attacks. The impact is limited to information disclosure.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive configuration data, potentially violating compliance requirements for data protection and privacy such as GDPR or HIPAA. Exposure of system configurations may result in non-compliance with security and privacy standards.

Mitigation Strategies

Upgrade OPNsense to version 26.1.11 or later immediately. If upgrading is not possible, apply input validation patches from the OPNsense/core repository commits 631e147 or d7054ce to sanitize delete tokens before XPath processing.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-58395. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart