Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-53582— OPNsense: XPATH Injection can disclose any secret in config.xml

Quick assessment

Affected
opnsense core
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

OPNsense 是一款基于 FreeBSD 的防火墙和路由平台。在版本 26.1.10 之前，Trust 模块会存储由攻击者控制的证书颁发机构（CA）和证书引用标识（refid）值，并将这些值插入到 XPath 表达式中，具体涉及以下两个文件： 和 。 拥有 CA 管理器或证书管理器权限的用户可以提交一个精心构造的 refid，并反复检索该对象，从而构建一个布尔类型的引用计数预言机（refcount oracle）。利用该预言机，攻击者可以逐字符地恢复 config.xml 配置文件中的敏感值。可能泄露的值包括密

CVSS 7.1 · High EPSS 0.73% · P53

Affected Version Matrix 1

VendorProduct Version RangeStatus
opnsense core < 26.1.10 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-53582

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
OPNsense: XPATH Injection can disclose any secret in config.xml
Source: CVE Program / CVE List V5
Vulnerability Description
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.10, the Trust module stores attacker-controlled certificate authority and certificate refid values and interpolates them into XPath expressions in src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CAsField.php and src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CertificatesField.php. A user with CA Manager or Certificate Manager privileges can submit a crafted refid and repeatedly retrieve the object to obtain a boolean refcount oracle, allowing values in config.xml to be recovered character by character. Exposed values can include password hashes, API credentials, certificate private keys, VPN key material, and high-availability credentials, enabling privilege escalation and compromise of other security domains. This issue is fixed in version 26.1.10.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
XML注入(XPath盲注)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
opnsense core < 26.1.10 -

II. Public POCs for CVE-2026-53582

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-53582

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-53582 (1)

Same Patch Batch · opnsense · 2026-10-15 · 10 CVEs total

CVE-2026-57155 9.9 CRITICAL OPNsense: Root RCE via Arbitrary File Write in GeoIP Alias Importer
CVE-2026-63442 8.1 HIGH OPNsense: Log Forgery via Login Username CRLF in WebGUI Authentication → Pf Table IP Block
CVE-2026-58390 8.0 HIGH OPNsense: Stored XSS to root RCE via OpenVPN client common_name in status views
CVE-2026-71490 7.1 HIGH OPNsense: Direct comma-separated user privileges bypass OPNsense MVC read-only write prote
CVE-2026-58393 5.9 MEDIUM OPNsense: OpenVPN Client Specific Override common_name allows path traversal in generated
CVE-2026-58391 5.4 MEDIUM OPNsense: Stored XSS in Firewall Rules/NAT pages via a HTML-attribute breakout
CVE-2026-58392 5.4 MEDIUM OPNsense: Stored XSS in Services: NTP GPS
CVE-2026-58394 5.2 MEDIUM OPNsense: Stored XSS in Administration Settings via Certificate Description
CVE-2026-58395 4.3 MEDIUM OPNsense: XPath injection in MVC safe-delete

IV. Related Vulnerabilities

Same product: core
Same vendor: opnsense
Same weakness: CWE-91

V. Comments for CVE-2026-53582

No comments yet

Leave a comment