PT-2026-31619 · Opnsense · Opnsense

Mandreko · Published 2026-04-09 · Updated 2026-04-09 · CVE-2026-34578

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions OPNsense versions prior to 26.1.6

Description OPNsense's LDAP authentication connector does not properly sanitize user-supplied input when constructing LDAP search filters. Specifically, the username provided during WebGUI login is directly incorporated into the LDAP filter without escaping special characters. This allows an unauthenticated attacker to inject LDAP filter metacharacters into the username field, potentially enabling them to enumerate valid LDAP usernames within the configured directory. If the LDAP server configuration includes an Extended Query to limit login access to members of a specific group, the same injection technique can be used to bypass this group membership restriction and authenticate as any LDAP user whose password is known, regardless of their group affiliation.

Recommendations Upgrade to OPNsense version 26.1.6 or later.

Exploit

Fix

Weakness Enumeration

CWE-90

Related Identifiers

CVE-2026-34578

Affected Products

Opnsense

References · 6

• 🔥 https://github.com/opnsense/core/security/advisories/GHSA-jpm7-f59c-mp54 · Exploit
• https://github.com/opnsense/core/commit/016f66cb4620cd48183fa97843f343bb71813c6e · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-34578 · Security Note
• https://twitter.com/CVEnew/status/2042302828744749188 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2042362093479809513 · Twitter Post
• https://twitter.com/RedHornet_Intel/status/2042255174782116071 · Twitter Post