CVE-2026-57154

Name of the Vulnerable Software and Affected Versions OPNsense versions prior to 26.1.11 OPNsense versions prior to 26.4.1p1

Description Authenticated Web UI or API users with delegated access to specific settings can inject Carriage Return (CR) or Line Feed (LF) characters into single-line fields. This allows the insertion of attacker-controlled directives or policy lines into privileged service configuration files. In the Dnsmasq path, affected variables include dhcp boot.filename, dhcp boot.servername, dhcp boot.address, and dhcp options.value, which are rendered into the /usr/local/etc/dnsmasq.conf file via the api/dnsmasq/* endpoint. Other affected areas include OpenVPN, DHCPv6, Unbound, IPsec, NTP, PPP or MPD, Monit, firewall, sudo, WebGUI, and System General configurations. Exploitation can lead to altered service behavior, creation of service-side files, bypassing of Role-Based Access Control (RBAC) boundaries, or denial of service. Specifically, line injection through Monit mail password and adjacent text fields into /usr/local/etc/monitrc can result in root command execution.

Recommendations Update to version 26.1.11. Update to version 26.4.1p1.