{"id":"CVE-2026-119423","kind":"vulnerability","aliases":["CVE-2026-119423"],"related":[],"title":"OPNsense: crafted login usernames let attackers lock out victim IPs","description":"OPNsense core before 26.7.8 contains a log injection vulnerability that allows unauthenticated attackers to plant victim IP addresses in the lockout_handler by submitting crafted WebGUI login usernames. Attackers can submit usernames like 'Invalid user <victim-ip>' repeatedly to add the victim to the sshlockout table, blocking SSH and WebGUI access and killing its pf states.","summary":"OPNsense core before 26.7.8 lets an unauthenticated attacker submit crafted WebGUI login usernames that get written into the lockout handler's logs. Repeated submissions can add a victim's IP address to the sshlockout table, blocking that victim from SSH and the WebGUI and killing its pf states.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["firewall","infrastructure","opnsense","pf","self-hosted"],"not_affected_if":["opnsense-26.7.8-or-later","webgui-not-exposed"],"how_to_check":"- Check the installed OPNsense version under System > Firmware or with `opnsense-version`; versions below `26.7.8` are in the affected range.\n- Look at the sshlockout table in pf (for example `pfctl -t sshlockout -T show`) for unexpected IP addresses.\n- Review WebGUI login failure entries in the system log for usernames containing embedded IP addresses.","fix":"- OPNsense core: move to `26.7.8` or later.","status":"open","published_at":"2026-10-30T12:16:39+00:00","first_seen_at":"2026-10-30T12:30:25+00:00","triaged_at":"2026-10-30T12:32:30+00:00","updated_at":"2026-10-30T12:32:30+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-30T12:32:30Z","model":"claude-haiku-5-5","output":{"fix":"- OPNsense core: move to `26.7.8` or later.","reach":"network","title":"OPNsense: crafted login usernames let attackers lock out victim IPs","impact":"low","summary":"OPNsense core before 26.7.8 lets an unauthenticated attacker submit crafted WebGUI login usernames that get written into the lockout handler's logs. Repeated submissions can add a victim's IP address to the sshlockout table, blocking that victim from SSH and the WebGUI and killing its pf states.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["opnsense","firewall","self-hosted","pf"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"attacker blocks victim IPs from SSH and WebGUI access","analyst_note":"","how_to_check":"- Check the installed OPNsense version under System > Firmware or with `opnsense-version`; versions below `26.7.8` are in the affected range.\n- Look at the sshlockout table in pf (for example `pfctl -t sshlockout -T show`) for unexpected IP addresses.\n- Review WebGUI login failure entries in the system log for usernames containing embedded IP addresses.","plain_action":"","needs_analyst":false,"not_affected_if":["opnsense-26.7.8-or-later","webgui-not-exposed"],"who_is_affected":"Any OPNsense firewall running core before 26.7.8 whose WebGUI is reachable by attackers, since the login form accepts the crafted usernames without authentication. Firewalls where the WebGUI is restricted to trusted management networks are less exposed. The sources do not say whether default configurations are affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00073,"input_tokens":4167,"output_tokens":626,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119423':13A,16A '-2026':12A,15A '26.7.8':27B,75C 'access':120C 'add':49B,109C 'address':54B,89C 'allow':82C 'attack':6A,31B,84C,100C 'block':59B,116C 'contain':76C 'core':25B,73C 'craft':2A,33B,96C 'cve':11A,14A 'firewal':17B 'get':38B 'handler':43B,93C 'host':23B 'infrastructur':18B 'inject':79C 'invalid':105C 'ip':10A,53B,88C 'kill':68B,122C 'let':5A,28B 'like':104C 'lock':7A 'lockout':42B,92C 'log':45B,78C 'login':3A,35B,98C 'opnsens':1A,19B,24B,72C 'pf':20B,70B,124C 'plant':86C 'repeat':46B,107C 'self':22B 'self-host':21B 'ssh':63B,117C 'sshlockout':57B,114C 'state':71B,125C 'submiss':47B 'submit':32B,95C,102C 'tabl':58B,115C 'unauthent':30B,83C 'user':106C 'usernam':4A,36B,99C,103C 'victim':9A,51B,61B,87C,111C 'vulner':80C 'webgui':34B,66B,97C,119C 'written':39B","nicknames":[],"mitigations":[],"who_affected":"Any OPNsense firewall running core before 26.7.8 whose WebGUI is reachable by attackers, since the login form accepts the crafted usernames without authentication. Firewalls where the WebGUI is restricted to trusted management networks are less exposed. The sources do not say whether default configurations are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T12:16:39+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119423","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119423","severity":null,"published_at":"2026-10-30T12:16:39+00:00","modified_at":"2026-10-30T12:16:39+00:00","first_seen_at":"2026-10-30T12:30:25+00:00","fetched_at":"2026-10-30T12:30:25+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}