CVE-2026-119560: OPNsense core through 26.7.8 NTP Configuration Injection via GPS and PPS Fudge Fields

Published Oct 30, 2026

Updated

OPNsense core through 26.7.8 contains a configuration injection vulnerability that allows authenticated users to append ntpd.conf directives by embedding newlines in the fudge and refid fields. Attackers holding the page-services-ntp-gps or PPS privilege can submit CR/LF characters via servicesntpdgps.php or servicesntpdpps.php to inject directives loaded by ntpd running as root.

Event History

Oct 30, 2026

CVE Published

via MITRE·11:31 AM

Data Sourced

via MITRE·11:31 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·12:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated user must hold the page-services-ntp-gps privilege or the PPS privilege. The affected inputs are exposed through the GPS and PPS NTP service pages.

What does exploitation require?

The attacker must submit carriage-return or line-feed characters in the fudge or refid fields. Exploitation has high attack complexity and requires low privileges, but does not require user interaction.

What is the impact of successful exploitation?

Injected directives are loaded into ntpd.conf by ntpd, which runs as root. The provided severity vector indicates high impact to integrity and low impact to availability, with no direct confidentiality impact.

How can I determine whether an instance is affected?

OPNsense core versions through 26.7.8 are affected. Review access to the NTP GPS and PPS configuration pages and inspect submitted or stored fudge and refid values for embedded CR/LF characters or unexpected ntpd.conf directives.

CVE-2026-119560: OPNsense core through 26.7.8 NTP Configuration Injection via GPS and PPS Fudge Fields

Event History

Frequently Asked Questions

Who can exploit this issue?

What does exploitation require?

What is the impact of successful exploitation?

How can I determine whether an instance is affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What does exploitation require?

What is the impact of successful exploitation?

How can I determine whether an instance is affected?