CVE-2026-53582

Name of the Vulnerable Software and Affected Versions OPNsense versions prior to 26.1.10

Description The Trust module contains a stored XPath injection flaw. A user with CA Manager or Certificate Manager privileges can submit a crafted refid value that is interpolated into XPath expressions within src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CAsField.php and src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CertificatesField.php. By repeatedly retrieving the object, an attacker can create a boolean refcount oracle to recover sensitive data from config.xml character by character. This leaked information may include password hashes, API credentials, certificate private keys, VPN key material, and high-availability credentials, potentially leading to privilege escalation and the compromise of other security domains.

Recommendations Update to version 26.1.10.