CVE-2026-30868

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-30868", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-05T21:27:35.343Z", "datePublished": "2026-03-11T16:38:12.883Z", "dateUpdated": "2026-03-11T17:20:20.867Z"}, "containers": {"cna": {"title": "Cross-Site Request Forgery (CSRF) in opnsense/core", "problemTypes": [{"descriptions": [{"cweId": "CWE-352", "lang": "en", "description": "CWE-352: Cross-Site Request Forgery (CSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/opnsense/core/security/advisories/GHSA-pp58-2qpc-3j3f", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/opnsense/core/security/advisories/GHSA-pp58-2qpc-3j3f"}], "affected": [{"vendor": "opnsense", "product": "core", "versions": [{"version": "< 26.1.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-11T16:38:12.883Z"}, "descriptions": [{"lang": "en", "value": "OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.4, multiple OPNsense MVC API endpoints perform state\u2011changing operations but are accessible via HTTP GET requests without CSRF protection. The framework CSRF validation in ApiControllerBase only applies to POST/PUT/DELETE methods, allowing authenticated GET requests to bypass CSRF verification. As a result, a malicious website can trigger privileged backend actions when visited by an authenticated user, causing unintended service reloads and configuration changes through configd. This results in an authenticated Cross\u2011Site Request Forgery vulnerability allowing unauthorized system state changes. This vulnerability is fixed in 26.1.4."}], "source": {"advisory": "GHSA-pp58-2qpc-3j3f", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-30868", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-11T17:06:10.354517Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T17:20:20.867Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-30868", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-11T17:06:10.354517Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T17:14:16.842Z"}}], "cna": {"title": "Cross-Site Request Forgery (CSRF) in opnsense/core", "source": {"advisory": "GHSA-pp58-2qpc-3j3f", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "opnsense", "product": "core", "versions": [{"status": "affected", "version": "< 26.1.4"}]}], "references": [{"url": "https://github.com/opnsense/core/security/advisories/GHSA-pp58-2qpc-3j3f", "name": "https://github.com/opnsense/core/security/advisories/GHSA-pp58-2qpc-3j3f", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.4, multiple OPNsense MVC API endpoints perform state\u2011changing operations but are accessible via HTTP GET requests without CSRF protection. The framework CSRF validation in ApiControllerBase only applies to POST/PUT/DELETE methods, allowing authenticated GET requests to bypass CSRF verification. As a result, a malicious website can trigger privileged backend actions when visited by an authenticated user, causing unintended service reloads and configuration changes through configd. This results in an authenticated Cross\u2011Site Request Forgery vulnerability allowing unauthorized system state changes. This vulnerability is fixed in 26.1.4."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352: Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-11T16:38:12.883Z"}}}, "cveMetadata": {"cveId": "CVE-2026-30868", "state": "PUBLISHED", "dateUpdated": "2026-03-11T17:20:20.867Z", "dateReserved": "2026-03-05T21:27:35.343Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-11T16:38:12.883Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "core", "vendor": "opnsense", "versions": [{"status": "affected", "version": "< 26.1.4"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:opnsense:opnsense:*:*:*:*:*:*:*:*", "matchCriteriaId": "03190C55-5F46-4CD4-944C-B7CA5BCC77F9", "versionEndExcluding": "26.1.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.4, multiple OPNsense MVC API endpoints perform state\u2011changing operations but are accessible via HTTP GET requests without CSRF protection. The framework CSRF validation in ApiControllerBase only applies to POST/PUT/DELETE methods, allowing authenticated GET requests to bypass CSRF verification. As a result, a malicious website can trigger privileged backend actions when visited by an authenticated user, causing unintended service reloads and configuration changes through configd. This results in an authenticated Cross\u2011Site Request Forgery vulnerability allowing unauthorized system state changes. This vulnerability is fixed in 26.1.4."}, {"lang": "es", "value": "OPNsense es una plataforma de cortafuegos y enrutamiento basada en FreeBSD. Antes de la versi\u00f3n 26.1.4, m\u00faltiples puntos finales de la API MVC de OPNsense realizan operaciones que cambian el estado, pero son accesibles a trav\u00e9s de solicitudes HTTP GET sin protecci\u00f3n CSRF. La validaci\u00f3n CSRF del framework en ApiControllerBase solo se aplica a los m\u00e9todos POST/PUT/DELETE, permitiendo que las solicitudes GET autenticadas omitan la verificaci\u00f3n CSRF. Como resultado, un sitio web malicioso puede desencadenar acciones privilegiadas en el backend cuando es visitado por un usuario autenticado, causando recargas de servicio y cambios de configuraci\u00f3n no deseados a trav\u00e9s de configd. Esto resulta en una vulnerabilidad de falsificaci\u00f3n de solicitud entre sitios (Cross-Site Request Forgery) autenticada que permite cambios de estado del sistema no autorizados. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 26.1.4."}], "id": "CVE-2026-30868", "lastModified": "2026-06-17T10:33:03.587", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-30868", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-11T17:06:10.354517Z", "version": "2.0.3"}}]}, "published": "2026-03-11T17:16:57.937", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/opnsense/core/security/advisories/GHSA-pp58-2qpc-3j3f"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,26.1.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "core", "source": "cna", "vendor": "opnsense"}, "product": "core", "vendor": "opnsense"}], "analysis": {"en": {"generated_at": "2026-03-17T20:45:00.228185+00:00", "value": {"mitigation_remediation": ["Upgrade to OPNsense 26.1.4 or later"], "summary": {"action": "Immediate Patch", "impact": "Authenticated CSRF leading to unauthorized configuration changes"}, "threat_synthesis": {"affected_systems": "All OPNsense core installations with versions prior to 26.1.4 are affected. The vendor identified the product as opnsense:core. The specific affected releases are those older than 26.1.4, as noted in the vendor advisory.", "description_and_impact": "This vulnerability allows an attacker to execute authenticated CSRF attacks against OPNsense. Multiple MVC API endpoints can perform state\u2011changing operations when accessed with HTTP GET requests without CSRF validation. A malicious website can cause an authenticated user to trigger privileged backend actions, resulting in unintended service reloads and configuration changes via configd. The primary impact is the ability to alter system configuration while the user is authenticated, which can lead to denial of service or other unintended behavior.", "risk_and_exploitability": "The CVSS score of 6.3 indicates a medium severity vulnerability. The EPSS score is below 1%, suggesting that current exploitation attempts are low. The vulnerability is not listed in the CISA KEV catalog. Exposition requires an authenticated session; the attack vector is a web-based CSRF triggered by a malicious site. Because the attacker needs a legitimate authenticated user to visit a malicious site, exploitation likelihood depends on user behavior and threat actor resources"}}}}, "created": "2026-03-12T09:57:47.184122+00:00", "updated": "2026-03-20T15:30:26.520951+00:00", "vendors": ["opnsense", "opnsense$PRODUCT$core"]}