CVE-2026-119423 json
OPNsense core before 26.7.8 Lockout IP Planting via WebGUI Login Username
published 2026-10-30 10 d ago modified 2026-11-04 5 d ago also EUVD-2026-113803
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 31%
- public exploits
- 0
- none known
Summary
OPNsense core before 26.7.8 contains a log injection vulnerability that allows unauthenticated attackers to plant victim IP addresses in the lockout_handler by submitting crafted WebGUI login usernames. Attackers can submit usernames like 'Invalid user <victim-ip>' repeatedly to add the victim to the sshlockout table, blocking SSH and WebGUI access and killing its pf states.
Patch / fix
- opnsense core 26.7.8
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 5 d ago
Exploit prediction
0.38% chance of exploitation in the next 30 days, higher than 31% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N |
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- opnsense core
Classification
- Weakness
-
- CWE-117 Improper Output Neutralization for Logs
References
-
github.com
/opnsense/core/commit/14f8f7dd1d5f06522d60794a7beeac7adb9eca68
patch
-
github.com
/opnsense/core/commit/2076f2c195bf9537ec220f0e5d6aff998f057410
patch
-
github.com
/opnsense/core/security/advisories/GHSA-2v2x-m4j7-76pv
vendor-advisory
-
github.com
/opnsense/core/blob/26.7.7/src/opnsense/mvc/app/library/OPNsense/Auth/AuthenticationFactory.php#L232
technical-description
-
github.com
/opnsense/core/blob/26.7.7/src/opnsense/scripts/syslog/lockout_handler#L70
technical-description
-
abraxaslabs.tech
/research/opnsense-lockout-factory-ip
third-party-advisory
-
github.com
/opnsense/core
product
-
vulncheck.com
/advisories/opnsense-core-before-26.7.8-lockout-ip-planting-via-webgui-login-username
third-party-advisory
Sources
- CVE List CVE-2026-119423
- NVD CVE-2026-119423
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.