OPNsense EUVD-2026-102112

Requires an authenticated OPNsense web-interface account holding CA Manager or Certificate Manager privileges (PR:L) - this is not a default anonymous attack surface. The attacker must submit a crafted refid in the Trust module's CA or Certificate objects, where the value is interpolated unescaped into an XPath expression (//*[text() = '{refid}']) in CAsField.php / CertificatesField.php, then repeatedly retrieve the object to read the boolean refcount/in_use result as an oracle. Exploitation is LIMITED by the need for those trust-management privileges and by its iterative, high-complexity nature (one boolean leak per request, so secrets are recovered character by character over many requests). Affected: all versions prior to 26.1.10; fixed in 26.1.10, which enforces a 13-hex-character format mask on refid before the XPath query.

This is a genuine but second-tier priority - a post-authentication information-disclosure flaw rather than a drive-by remote compromise. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:L, base 7.1 High) correctly captures the shape: network-reachable via the web management interface, but gated behind PR:L (the attacker must already hold CA Manager or Certificate Manager privileges) and rated AC:H because exploitation is a blind, character-by-character refcount oracle requiring many iterative requests rather than a single deterministic payload. The scope change (S:C) is the key severity driver - a low-privileged trust-module operator can recover secrets belonging to entirely different security domains (password hashes, API credentials, private keys, VPN and HA material), enabling privilege escalation. No EPSS score, no KEV listing, and no public POC were provided; the only exploitation evidence is the vendor's own fix commits. Signals are consistent (no conflicts): all point to a credentialed insider/compromised-account threat model, not mass internet exploitation. Missing data: EPSS probability is absent, so real-world exploitation likelihood cannot be quantified. Note one minor divergence - the published vector asserts A:L, but the described impact is purely confidentiality/disclosure with no clear availability degradation; verify the A:L justification with the vendor.

An attacker who has obtained a low-privileged OPNsense account scoped to CA Manager or Certificate Manager (via phishing, credential reuse, or a rogue delegated admin) submits crafted certificate/CA refid values and repeatedly re-reads the object, using the returned boolean 'in use' refcount as an oracle to reconstruct arbitrary config.xml values one character at a time. Over many requests they extract root/admin password hashes, API keys, and VPN private keys, then pivot to full firewall compromise. No public exploit code was identified at time of analysis, though the fix commits reveal the exact vulnerable XPath sinks.