---
id: "CVE-2026-119423"
kind: "vulnerability"
aliases: ["CVE-2026-119423"]
title: "OPNsense: crafted login usernames let attackers lock out victim IPs"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["firewall", "infrastructure", "opnsense", "pf", "self-hosted"]
not_affected_if: ["opnsense-26.7.8-or-later", "webgui-not-exposed"]
published_at: "2026-10-30T12:16:39+00:00"
first_seen_at: "2026-10-30T12:30:25+00:00"
updated_at: "2026-10-30T12:32:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119423", "first_seen_at": "2026-10-30T12:30:25+00:00"}]
---

# OPNsense: crafted login usernames let attackers lock out victim IPs

OPNsense core before 26.7.8 lets an unauthenticated attacker submit crafted WebGUI login usernames that get written into the lockout handler's logs. Repeated submissions can add a victim's IP address to the sshlockout table, blocking that victim from SSH and the WebGUI and killing its pf states.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed OPNsense version under System > Firmware or with `opnsense-version`; versions below `26.7.8` are in the affected range.
- Look at the sshlockout table in pf (for example `pfctl -t sshlockout -T show`) for unexpected IP addresses.
- Review WebGUI login failure entries in the system log for usernames containing embedded IP addresses.

## Fix

- OPNsense core: move to `26.7.8` or later.

## Timeline

- 2026-10-30T12:30:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119423

## From the sources

OPNsense core before 26.7.8 contains a log injection vulnerability that allows unauthenticated attackers to plant victim IP addresses in the lockout_handler by submitting crafted WebGUI login usernames. Attackers can submit usernames like 'Invalid user <victim-ip>' repeatedly to add the victim to the sshlockout table, blocking SSH and WebGUI access and killing its pf states.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_