{"id":"CVE-2026-119560","kind":"vulnerability","aliases":["CVE-2026-119560"],"related":[],"title":"OPNsense: authenticated users can inject NTP daemon config directives","description":"OPNsense core through 26.7.8 contains a configuration injection vulnerability that allows authenticated users to append ntpd.conf directives by embedding newlines in the fudge and refid fields. Attackers holding the page-services-ntp-gps or PPS privilege can submit CR/LF characters via services_ntpd_gps.php or services_ntpd_pps.php to inject directives loaded by ntpd running as root.","summary":"OPNsense core through 26.7.8 lets a user with the NTP GPS or PPS privilege embed newlines in the fudge and refid fields, appending arbitrary directives to ntpd.conf. Because ntpd runs as root, the injected directives can be used to escalate privileges on the firewall.","severity":"medium","cvss":6.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["firewall","infrastructure","ntp","opnsense"],"not_affected_if":["no-ntp-gps-or-pps-privilege-users","patched-version"],"how_to_check":"- Check the installed OPNsense version under System > Firmware or with `opnsense-version`, and compare it to the affected range through `26.7.8`.\n- Review which accounts hold the page-services-ntp-gps or PPS privilege under System > Access > Users and Groups.\n- Inspect `/usr/local/etc/ntpd.conf` for unexpected directives after the GPS or PPS settings.","fix":"- OPNsense core: move to a release newer than `26.7.8`; the exact fixed version is unknown from the sources.","status":"open","published_at":"2026-10-30T12:16:43+00:00","first_seen_at":"2026-10-30T12:30:26+00:00","triaged_at":"2026-10-30T12:32:48+00:00","updated_at":"2026-10-30T12:32:48+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-30T12:32:48Z","model":"claude-haiku-5-5","output":{"fix":"- OPNsense core: move to a release newer than `26.7.8`; the exact fixed version is unknown from the sources.","reach":"network","title":"OPNsense: authenticated users can inject NTP daemon config directives","impact":"high","summary":"OPNsense core through 26.7.8 lets a user with the NTP GPS or PPS privilege embed newlines in the fudge and refid fields, appending arbitrary directives to ntpd.conf. Because ntpd runs as root, the injected directives can be used to escalate privileges on the firewall.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["opnsense","firewall","ntp"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Injected directives run with root privileges through ntpd on the firewall","analyst_note":"Confirm the fixed OPNsense version and whether default installs grant the NTP GPS or PPS privilege, using the NVD entry linked in the sources.","how_to_check":"- Check the installed OPNsense version under System > Firmware or with `opnsense-version`, and compare it to the affected range through `26.7.8`.\n- Review which accounts hold the page-services-ntp-gps or PPS privilege under System > Access > Users and Groups.\n- Inspect `/usr/local/etc/ntpd.conf` for unexpected directives after the GPS or PPS settings.","plain_action":"","needs_analyst":true,"not_affected_if":["no-ntp-gps-or-pps-privilege-users","patched-version"],"who_is_affected":"Exposed systems are OPNsense firewalls running core through 26.7.8 where some users hold the NTP GPS or PPS page privilege. Administrators who restrict those privileges to fully trusted staff face less risk. The sources do not say whether default installs grant these privileges.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000757,"input_tokens":4164,"output_tokens":681,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119560':12A,15A '-2026':11A,14A '26.7.8':23B,67C 'allow':74C 'append':42B,78C 'arbitrari':43B 'attack':90C 'authent':2A,75C 'charact':104C 'config':8A 'configur':70C 'contain':68C 'core':21B,65C 'cr/lf':103C 'cve':10A,13A 'daemon':7A 'direct':9A,44B,54B,80C,111C 'emb':34B 'embed':82C 'escal':59B 'field':41B,89C 'firewal':16B,63B 'fudg':38B,86C 'gps':30B,97C 'hold':91C 'infrastructur':17B 'inject':5A,53B,71C,110C 'let':24B 'load':112C 'newlin':35B,83C 'ntp':6A,18B,29B,96C 'ntpd':48B,114C 'ntpd.conf':46B,79C 'opnsens':1A,19B,20B,64C 'page':94C 'page-services-ntp-gp':93C 'pps':32B,99C 'privileg':33B,60B,100C 'refid':40B,88C 'root':51B,117C 'run':49B,115C 'servic':95C 'services_ntpd_gps.php':106C 'services_ntpd_pps.php':108C 'submit':102C 'use':57B 'user':3A,26B,76C 'via':105C 'vulner':72C","nicknames":[],"mitigations":[],"who_affected":"Exposed systems are OPNsense firewalls running core through 26.7.8 where some users hold the NTP GPS or PPS page privilege. Administrators who restrict those privileges to fully trusted staff face less risk. The sources do not say whether default installs grant these privileges.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T12:16:43+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119560","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119560","severity":null,"published_at":"2026-10-30T12:16:43+00:00","modified_at":"2026-10-30T12:16:43+00:00","first_seen_at":"2026-10-30T12:30:26+00:00","fetched_at":"2026-10-30T12:30:26+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}