CVE-2026-119560

OPNsense core through 26.7.8 contains a configuration injection vulnerability that allows authenticated users to append ntpd.conf directives by embedding newlines in the fudge and refid fields. Attackers holding the page-services-ntp-gps or PPS privilege can submit CR/LF characters via services ntpd gps.php or services ntpd pps.php to inject directives loaded by ntpd running as root.