CVE-2026-119423

EUVD-2026-113803
OPNsense core before 26.7.8 contains a log injection vulnerability that allows unauthenticated attackers to plant victim IP addresses in the lockout_handler by submitting crafted WebGUI login usernames. Attackers can submit usernames like 'Invalid user <victim-ip>' repeatedly to add the victim to the sshlockout table, blocking SSH and WebGUI access and killing its pf states.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
opnsenseopnsense
𝑥
< 26.7.8
CNA
Common Weakness Enumeration
References
https://abraxaslabs.tech/research/opnsense-lockout-factory-ip
https://github.com/opnsense/core
https://github.com/opnsense/core/blob/26.7.7/src/opnsense/mvc/app/library/OPNsense/Auth/AuthenticationFactory.php#L232
https://github.com/opnsense/core/blob/26.7.7/src/opnsense/scripts/syslog/lockout_handler#L70
https://github.com/opnsense/core/commit/14f8f7dd1d5f06522d60794a7beeac7adb9eca68
https://github.com/opnsense/core/commit/2076f2c195bf9537ec220f0e5d6aff998f057410
https://github.com/opnsense/core/security/advisories/GHSA-2v2x-m4j7-76pv
https://www.vulncheck.com/advisories/opnsense-core-before-26.7.8-lockout-ip-planting-via-webgui-login-username