CVE-2026-58395 opnsense CVE debrief

Who should care

OPNsense administrators and users with module privileges should assess exposure and apply patches to prevent potential configuration data exposure. The vulnerability allows an authenticated user to inject XPath into the safe-delete path, potentially exposing configuration data across modules. Administrators should review and monitor configuration data access and modifications, and restrict access to affected delete endpoints.

Why it matters

The vulnerability allows an authenticated user to inject XPath into the safe-delete path, potentially exposing configuration data across modules. OPNsense administrators should assess exposure and apply patches to prevent potential configuration data exposure.

• Potential exposure of configuration item names, descriptions, reference paths, and UUIDs
• XPath substring-presence oracle for modules the user cannot otherwise access
• Error response exposure of sensitive configuration data
• Verification priority for OPNsense administrators to ensure patch application

Technical summary

The OPNsense safe-delete path is vulnerable to XPath injection, allowing an authenticated user with any affected module privilege to potentially expose configuration data across modules. The issue arises from the unsafe interpolation of an unvalidated safe-delete token from the request URL into an XPath expression over config.xml. The vulnerability is fixed in version 26.1.11, and administrators should assess exposure and apply patches to prevent potential configuration data exposure. The vulnerability does not modify configuration or perform a deletion but can provide an XPath substring-presence oracle.

Defensive priority

Medium priority for OPNsense administrators to assess exposure and apply patches

Recommended defensive actions

• Assess exposure by checking if the current OPNsense version is prior to 26.1.11
• Apply patches or upgrade to version 26.1.11 or later
• Review and monitor configuration data access and modifications
• Restrict access to affected delete endpoints
• Verify patch application and review system logs for potential exploitation attempts
• Conduct a thorough review of system configurations and user access controls
• Implement additional monitoring and detection measures to identify potential security incidents

Evidence notes

The CVE record and source item provide details on the vulnerability, affected versions, and fixed version 26.1.11. However, there is limited information on potential exploitation or victim impact. OPNsense administrators should verify their deployments and apply patches to prevent potential configuration data exposure. The vulnerability allows an authenticated user to inject XPath into the safe-delete path, potentially exposing configuration data across modules.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.