CVE-2026-53582 opnsense CVE debrief

Who should care

System administrators and security teams responsible for OPNsense installations, particularly those with CA Manager or Certificate Manager privileges, should assess exposure and prioritize remediation.

Why it matters

This vulnerability allows an attacker to disclose sensitive information from config.xml, potentially leading to privilege escalation and compromise of other security domains.

• Privilege escalation and compromise of other security domains
• Disclosure of sensitive information, including password hashes and API credentials
• Potential for lateral movement and further exploitation

Technical summary

The Trust module in OPNsense stores attacker-controlled certificate authority and certificate refid values and interpolates them into XPath expressions. A user with CA Manager or Certificate Manager privileges can submit a crafted refid and repeatedly retrieve the object to obtain a boolean refcount oracle, allowing values in config.xml to be recovered character by character. This issue enables disclosure of sensitive information, including password hashes, API credentials, certificate private keys, VPN key material, and high-availability credentials.

Defensive priority

High

Recommended defensive actions

• Upgrade to version 26.1.10 or later
• Restrict CA Manager and Certificate Manager privileges
• Monitor config.xml for unauthorized access
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and fixed version. The Trust module in OPNsense stores attacker-controlled certificate authority and certificate refid values and interpolates them into XPath expressions in src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CAsField.php and src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CertificatesField.php. A user with CA Manager or Certificate Manager privileges can submit a crafted refid and repeatedly to

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.