CVE-2026-34578

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-34578", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-30T16:56:30.998Z", "datePublished": "2026-04-09T14:34:20.158Z", "dateUpdated": "2026-04-09T17:45:23.099Z"}, "containers": {"cna": {"title": "OPNsense has an LDAP Injection via Unsanitized Username in Authentication", "problemTypes": [{"descriptions": [{"cweId": "CWE-90", "lang": "en", "description": "CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/opnsense/core/security/advisories/GHSA-jpm7-f59c-mp54", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/opnsense/core/security/advisories/GHSA-jpm7-f59c-mp54"}, {"name": "https://github.com/opnsense/core/commit/016f66cb4620cd48183fa97843f343bb71813c6e", "tags": ["x_refsource_MISC"], "url": "https://github.com/opnsense/core/commit/016f66cb4620cd48183fa97843f343bb71813c6e"}], "affected": [{"vendor": "opnsense", "product": "core", "versions": [{"version": "< 26.1.6", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-09T14:34:20.158Z"}, "descriptions": [{"lang": "en", "value": "OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.6, OPNsense's LDAP authentication connector passes the login username directly into an LDAP search filter without calling ldap_escape(). An unauthenticated attacker can inject LDAP filter metacharacters into the username field of the WebGUI login page to enumerate valid LDAP usernames in the configured directory. When the LDAP server configuration includes an Extended Query to restrict login to members of a specific group, the same injection can be used to bypass that group membership restriction and authenticate as any LDAP user whose password is known, regardless of group membership. This vulnerability is fixed in 26.1.6."}], "source": {"advisory": "GHSA-jpm7-f59c-mp54", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/opnsense/core/security/advisories/GHSA-jpm7-f59c-mp54", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-09T17:45:17.527281Z", "id": "CVE-2026-34578", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-09T17:45:23.099Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-34578", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-30T16:56:30.998Z", "datePublished": "2026-04-09T14:34:20.158Z", "dateUpdated": "2026-04-09T17:45:23.099Z"}, "containers": {"cna": {"title": "OPNsense has an LDAP Injection via Unsanitized Username in Authentication", "problemTypes": [{"descriptions": [{"cweId": "CWE-90", "lang": "en", "description": "CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/opnsense/core/security/advisories/GHSA-jpm7-f59c-mp54", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/opnsense/core/security/advisories/GHSA-jpm7-f59c-mp54"}, {"name": "https://github.com/opnsense/core/commit/016f66cb4620cd48183fa97843f343bb71813c6e", "tags": ["x_refsource_MISC"], "url": "https://github.com/opnsense/core/commit/016f66cb4620cd48183fa97843f343bb71813c6e"}], "affected": [{"vendor": "opnsense", "product": "core", "versions": [{"version": "< 26.1.6", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-09T14:34:20.158Z"}, "descriptions": [{"lang": "en", "value": "OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.6, OPNsense's LDAP authentication connector passes the login username directly into an LDAP search filter without calling ldap_escape(). An unauthenticated attacker can inject LDAP filter metacharacters into the username field of the WebGUI login page to enumerate valid LDAP usernames in the configured directory. When the LDAP server configuration includes an Extended Query to restrict login to members of a specific group, the same injection can be used to bypass that group membership restriction and authenticate as any LDAP user whose password is known, regardless of group membership. This vulnerability is fixed in 26.1.6."}], "source": {"advisory": "GHSA-jpm7-f59c-mp54", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-34578", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-09T17:45:17.527281Z"}}}], "references": [{"url": "https://github.com/opnsense/core/security/advisories/GHSA-jpm7-f59c-mp54", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-09T17:45:11.030Z"}}]}}

{"affected": [{"affectedData": [{"product": "core", "vendor": "opnsense", "versions": [{"status": "affected", "version": "< 26.1.6"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:opnsense:opnsense:*:*:*:*:*:*:*:*", "matchCriteriaId": "651745DD-B6F9-404D-8F67-A82F0C649470", "versionEndExcluding": "26.1.6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.6, OPNsense's LDAP authentication connector passes the login username directly into an LDAP search filter without calling ldap_escape(). An unauthenticated attacker can inject LDAP filter metacharacters into the username field of the WebGUI login page to enumerate valid LDAP usernames in the configured directory. When the LDAP server configuration includes an Extended Query to restrict login to members of a specific group, the same injection can be used to bypass that group membership restriction and authenticate as any LDAP user whose password is known, regardless of group membership. This vulnerability is fixed in 26.1.6."}, {"lang": "es", "value": "OPNsense es una plataforma de cortafuegos y enrutamiento basada en FreeBSD. Antes de la versi\u00f3n 26.1.6, el conector de autenticaci\u00f3n LDAP de OPNsense pasa el nombre de usuario de inicio de sesi\u00f3n directamente a un filtro de b\u00fasqueda LDAP sin llamar a ldap_escape(). Un atacante no autenticado puede inyectar metacaracteres de filtro LDAP en el campo de nombre de usuario de la p\u00e1gina de inicio de sesi\u00f3n de la WebGUI para enumerar nombres de usuario LDAP v\u00e1lidos en el directorio configurado. Cuando la configuraci\u00f3n del servidor LDAP incluye una Consulta Extendida para restringir el inicio de sesi\u00f3n a miembros de un grupo espec\u00edfico, la misma inyecci\u00f3n puede usarse para eludir esa restricci\u00f3n de membres\u00eda de grupo y autenticarse como cualquier usuario LDAP cuya contrase\u00f1a sea conocida, independientemente de la membres\u00eda de grupo. Esta vulnerabilidad se corrige en la versi\u00f3n 26.1.6."}], "id": "CVE-2026-34578", "lastModified": "2026-10-26T22:10:00.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34578", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-09T17:45:17.527281Z", "version": "2.0.3"}}]}, "published": "2026-04-09T15:16:10.777", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/opnsense/core/commit/016f66cb4620cd48183fa97843f343bb71813c6e"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/opnsense/core/security/advisories/GHSA-jpm7-f59c-mp54"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/opnsense/core/security/advisories/GHSA-jpm7-f59c-mp54"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-90"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,26.1.6)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "core", "source": "cna", "vendor": "opnsense"}, "product": "core", "vendor": "opnsense"}], "analysis": {"en": {"generated_at": "2026-04-14T21:39:16.068629+00:00", "value": {"mitigation_remediation": ["Apply the 26.1.6 or later update to eliminate the injection flaw", "Limit exposure of the WebGUI by restricting it to trusted networks or requiring VPN", "Disable or remove the LDAP authentication connector if not required for operation"], "summary": {"action": "Immediate Patch", "impact": "LDAP Injection enabling username enumeration and potential group bypass"}, "threat_synthesis": {"affected_systems": "The flaw exists in the OPNsense core platform, affecting every installation that runs a version earlier than 26.1.6. The vulnerability is tied to the LDAP authentication connector and is present as long as the default login form is used. The CPE indicates the product is opnsense:opnsense.", "description_and_impact": "This vulnerability is an LDAP injection in OPNsense's authentication mechanism. By entering LDAP filter characters into the username field of the WebGUI login page, an unauthenticated attacker can cause the gateway to perform arbitrary LDAP searches. This allows enumeration of valid LDAP usernames and, when the LDAP server is configured with an Extended Query that restricts login to a specific group, enables an attacker to bypass that restriction and authenticate as any LDAP user for whom they know the password. The weakness follows cwe.mitre.org data definitions 90.", "risk_and_exploitability": "The CVSS score of 8.2 places this issue in the high severity range. Although the EPSS score is below 1%, indicating low estimated exploitation probability, the flaw is not listed in CISA's KEV catalog. An attacker with network access to the WebGUI can exploit the injection without authentication. Successful exploitation could lead to unauthorized enumeration of directory users and potential elevation of privileges by bypassing group restrictions. The attack path is straightforward and requires only the ability to submit a crafted username."}}}}, "created": "2026-04-10T08:53:31.761619+00:00", "updated": "2026-04-15T16:00:07.809363+00:00", "vendors": ["opnsense", "opnsense$PRODUCT$core"]}