---
id: "CVE-2026-119560"
kind: "vulnerability"
aliases: ["CVE-2026-119560"]
title: "OPNsense: authenticated users can inject NTP daemon config directives"
severity: "medium"
cvss: 6.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["firewall", "infrastructure", "ntp", "opnsense"]
not_affected_if: ["no-ntp-gps-or-pps-privilege-users", "patched-version"]
published_at: "2026-10-30T12:16:43+00:00"
first_seen_at: "2026-10-30T12:30:26+00:00"
updated_at: "2026-10-30T12:32:48+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119560", "first_seen_at": "2026-10-30T12:30:26+00:00"}]
---

# OPNsense: authenticated users can inject NTP daemon config directives

OPNsense core through 26.7.8 lets a user with the NTP GPS or PPS privilege embed newlines in the fudge and refid fields, appending arbitrary directives to ntpd.conf. Because ntpd runs as root, the injected directives can be used to escalate privileges on the firewall.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed OPNsense version under System > Firmware or with `opnsense-version`, and compare it to the affected range through `26.7.8`.
- Review which accounts hold the page-services-ntp-gps or PPS privilege under System > Access > Users and Groups.
- Inspect `/usr/local/etc/ntpd.conf` for unexpected directives after the GPS or PPS settings.

## Fix

- OPNsense core: move to a release newer than `26.7.8`; the exact fixed version is unknown from the sources.

## Timeline

- 2026-10-30T12:30:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119560

## From the sources

OPNsense core through 26.7.8 contains a configuration injection vulnerability that allows authenticated users to append ntpd.conf directives by embedding newlines in the fudge and refid fields. Attackers holding the page-services-ntp-gps or PPS privilege can submit CR/LF characters via services_ntpd_gps.php or services_ntpd_pps.php to inject directives loaded by ntpd running as root.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_