Live › vulnerability › CVE-2026-119423
OPNsense core before 26.7.8 lets an unauthenticated attacker submit crafted WebGUI login usernames that get written into the lockout handler's logs. Repeated submissions can add a victim's IP address to the sshlockout table, blocking that victim from SSH and the WebGUI and killing its pf states.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 12:30 UTC. All times on this page are UTC.
Any OPNsense firewall running core before 26.7.8 whose WebGUI is reachable by attackers, since the login form accepts the crafted usernames without authentication. Firewalls where the WebGUI is restricted to trusted management networks are less exposed. The sources do not say whether default configurations are affected.
No product ranges from the sources yet.
opnsense-version; versions below 26.7.8 are in the affected range.pfctl -t sshlockout -T show) for unexpected IP addresses.26.7.8 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
OPNsense core before 26.7.8 contains a log injection vulnerability that allows unauthenticated attackers to plant victim IP addresses in the lockout_handler by submitting crafted WebGUI login usernames. Attackers can submit usernames like 'Invalid user <victim-ip>' repeatedly to add the victim to the sshlockout table, blocking SSH and WebGUI access and killing its pf states.
This page as .md · .json · in your agent: get_signal("CVE-2026-119423")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.