PT-2026-24742 · Git+1 · Core+1

Oliverjueguen · Published 2026-03-11 · Updated 2026-03-12 · CVE-2026-30868

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions OPNsense versions prior to 26.1.4

Description OPNsense is a FreeBSD based firewall and routing platform. Multiple OPNsense MVC API endpoints perform state-changing operations but are accessible via HTTP GET requests without Cross-Site Request Forgery (CSRF) protection. The framework CSRF validation in ApiControllerBase only applies to POST, PUT, and DELETE methods, allowing authenticated GET requests to bypass CSRF verification. A malicious website can trigger privileged backend actions when visited by an authenticated user, causing unintended service reloads and configuration changes through configd. This results in an authenticated Cross-Site Request Forgery issue allowing unauthorized system state changes. The affected API endpoints are vulnerable due to the lack of CSRF protection on GET requests. The configd process is used for configuration changes.

Recommendations Versions prior to 26.1.4 should be updated to version 26.1.4 or later.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-30868

GHSA-PP58-2QPC-3J3F

Affected Products

Core

Opnsense

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30868.json · Exploit
• https://github.com/opnsense/core/security/advisories/GHSA-pp58-2qpc-3j3f · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-30868 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30868 · Security Note
• https://twitter.com/CVEnew/status/2031992411866701960 · Twitter Post
• https://twitter.com/infoflowcloud/status/2031994084852744282 · Twitter Post
• https://t.me/CVEtracker/47149 · Telegram Post