CVE-2026-119424: OPNsense before 26.7.8 Wireless WPA Configuration Line Injection via Identity
Published Oct 30, 2026
·Updated
OPNsense core before 26.7.8 contains a configuration line injection vulnerability that allows authenticated users with wireless-edit privilege to inject directives by embedding CR/LF characters in WPA fields. Attackers can place newlines in wpa.identity, wpa.passphrase, or RADIUS shared secrets to append arbitrary wpasupplicant or hostapd directives loaded by root-run daemons.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OPNsense coreto a version that resolves this vulnerability.Fixed in 26.7.8
Event History
Oct 30, 2026
CVE Published
via MITRE·11:30 AM
Data Sourced
via MITRE·11:30 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·12:16 PM
DescriptionSeverityWeakness