CVE-2026-34578: falha de alta gravidade em opnsense core
OPNsense has an LDAP Injection via Unsanitized Username in Authentication
Publicada em
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.2epss 0.5%
probabilidade de exploração
0.5%top 61% das CVEs
exploração observada
nãonenhuma fonte reporta
OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.6, OPNsense's LDAP authentication connector passes the login username directly into an LDAP search filter without calling ldap_escape(). An unauthenticated attacker can inject LDAP filter metacharacters into the username field of the WebGUI login page to enumerate valid LDAP usernames in the configured directory. When the LDAP server configuration includes an Extended Query to restrict login to members of a specific group, the same injection can be used to bypass that group membership restriction and authenticate as any LDAP user whose password is known, regardless of group membership. This vulnerability is fixed in 26.1.6.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Produtos afetados
opnsense · coreCVEs relacionadas — opnsense core
No mesmo produto, das mais perigosas para as menos.
CVE-2026-44193CRITICALOPNsense: RCE via XMLRPC endpoint using `opnsense.restore_config_section` methodEPSS 0.9%CVE-2026-45158CRITICALOPNsense: Command Injection via Attacker-Controlled DHCP ConfigEPSS 0.8%CVE-2026-44194CRITICALOPNsense: RCE on user managmentEPSS 0.8%CVE-2026-53581CRITICALntp: write path traversalEPSS 0.5%CVE-2026-44195MEDIUMOPNsense: Authentication lockout bypassEPSS 0.4%CVE-2026-30868MEDIUMCross-Site Request Forgery (CSRF) in opnsense/coreEPSS 0.2%