CVE-2026-113779 pfrest CVE debrief

Who should care

Defenders responsible for pfSense installations using the REST API package should assess exposure and prioritize patching to version 2.9.0 or later. They should also restrict access to API endpoints to trusted administrative users due to the potential for privilege escalation and modification of REST API configuration secrets. This includes reviewing compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

Defenders should prioritize patching to version 2.9.0 or later and restrict access to API endpoints to trusted administrative users due to the potential for privilege escalation and modification of REST API configuration secrets.

• Potential privilege escalation for non-administrative users
• Possible modification of REST API configuration secrets
• Elevation of privileges to a full administrator

Technical summary

The pfSense REST API package is vulnerable to privilege escalation via scoped HA settings sync permission. Authenticated accounts with the dedicated settings sync permission can modify REST API configuration secrets, allowing non-administrative users to elevate their privileges to a full administrator. The issue is patched in version 2.9.0, which also includes hardening measures such as opt-in default and format and validation modernization. Defenders should prioritize patching to version 2.9.0 or later and restrict access to API endpoints to trusted administrative users due to the potential for privilege escalation and modification of REST API configuration secrets.

Defensive priority

Defenders should prioritize patching to version 2.9.0 or later and restrict access to API endpoints to trusted administrative users.

Recommended defensive actions

• Patch pfSense-pkg-RESTAPI to version 2.9.0 or later
• Revoke Scoped Permissions: Remove the `api-v2-system-restapi-settings-sync-post` privilege from all non-administrative users
• Apply ACLs: Configure REST API Access Control Lists (ACLs) and/or firewall rules to restrict access to API endpoints exclusively to trusted administrative users
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source item provide details on the vulnerability, affected versions, and patched version. The pfSense REST API package is vulnerable to privilege escalation via scoped HA settings sync permission. Authenticated accounts with the dedicated settings sync permission can modify REST API configuration secrets, allowing non-administrative users to elevate their privileges to a full administrator. The issue is patched in version 2.9.0, which also includes hardening measures. Defenders should verify the affected scope, and

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.