Opnsense
CVE-2026-30868
MEDIUM
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.4, multiple OPNsense MVC API endpoints perform state‑changing operations but are accessible via HTTP GET requests without CSRF protection. The framework CSRF validation in ApiControllerBase only applies to POST/PUT/DELETE methods, allowing authenticated GET requests to bypass CSRF verification. As a result, a malicious website can trigger privileged backend actions when visited by an authenticated user, causing unintended service reloads and configuration changes through configd. This results in an authenticated Cross‑Site Request Forgery vulnerability allowing unauthorized system state changes. This vulnerability is fixed in 26.1.4.
AnalysisAI
OPNsense prior to version 26.1.4 contains a CSRF vulnerability where state-changing API endpoints accept HTTP GET requests without proper anti-CSRF protections, allowing authenticated users to be tricked into triggering unintended system operations. An attacker can craft a malicious website that, when visited by an authenticated OPNsense administrator, performs unauthorized configuration changes or service reloads through the vulnerable endpoints. No patch is currently available for this medium-severity vulnerability affecting OPNsense firewall deployments.
Technical ContextAI
This vulnerability (CWE-352: Cross-Site Request Forgery (CSRF)) affects OPNsense is a FreeBSD based firewall and routing platform.. OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.4, multiple OPNsense MVC API endpoints perform state‑changing operations but are accessible via HTTP GET requests without CSRF protection. The framework CSRF validation in ApiControllerBase only applies to POST/PUT/DELETE methods, allowing authenticated GET requests to bypass CSRF verification. As a result, a malicious website can trigger privileged backend actions when visited by an authenticated user, causing unintended s
RemediationAI
Fixed in version 26.1.4.. Restrict network access to the affected service where possible.
Insecure permissions in the configuration directory (/conf/) of OPNsense Community Edition before 23.7 and Business Edit
DECISO OPNsense 23.1 does not impose rate limits for authentication, allowing attackers to perform a brute-force attack
A command injection vulnerability in the component /api/cron/settings/setJob/ of OPNsense Community Edition before 23.7
A command injection vulnerability in the component diag_backup.php of OPNsense Community Edition before 23.7 and Busines
/ui/cron/item/open in the Cron component of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 al
OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 was discovered to contain insecure permissions
Insecure permissions exist for configd.socket in OPNsense Community Edition before 23.7 and Business Edition before 23.4
A directory traversal vulnerability in the Captive Portal templates of OPNsense Community Edition before 23.7 and Busine
A Cross-Site Request Forgery (CSRF) in the System Halt API (/system/halt) of OPNsense Community Edition before 23.7 and
OPNsense 19.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicio
OPNsense 19.1 contains a stored cross-site scripting vulnerability in the system_advanced_sysctl.php endpoint that allow
OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject ma
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today