PT-2026-24742 · Git+1 · Core+1

Oliverjueguen · Publicado 2026-03-11 · Atualizado 2026-03-12 · CVE-2026-30868

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions OPNsense versions prior to 26.1.4

Description OPNsense is a FreeBSD based firewall and routing platform. Multiple OPNsense MVC API endpoints perform state-changing operations but are accessible via HTTP GET requests without Cross-Site Request Forgery (CSRF) protection. The framework CSRF validation in ApiControllerBase only applies to POST, PUT, and DELETE methods, allowing authenticated GET requests to bypass CSRF verification. A malicious website can trigger privileged backend actions when visited by an authenticated user, causing unintended service reloads and configuration changes through configd. This results in an authenticated Cross-Site Request Forgery issue allowing unauthorized system state changes. The affected API endpoints are vulnerable due to the lack of CSRF protection on GET requests. The configd process is used for configuration changes.

Recommendations Versions prior to 26.1.4 should be updated to version 26.1.4 or later.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2026-30868

GHSA-PP58-2QPC-3J3F

Produtos afetados

Core

Opnsense

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30868.json · Exploit
• https://github.com/opnsense/core/security/advisories/GHSA-pp58-2qpc-3j3f · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-30868 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2031992411866701960 · Publicação no Twitter
• https://twitter.com/infoflowcloud/status/2031994084852744282 · Publicação no Twitter
• https://t.me/CVEtracker/47149 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-30868 · Nota de Segurança