CVE-2026-30868: Cross-Site Request Forgery (CSRF) in opnsense/core
OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.4, multiple OPNsense MVC API endpoints perform state‑changing operations but are accessible via HTTP GET requests without CSRF protection. The framework CSRF validation in ApiControllerBase only applies to POST/PUT/DELETE methods, allowing authenticated GET requests to bypass CSRF verification. As a result, a malicious website can trigger privileged backend actions when visited by an authenticated user, causing unintended service reloads and configuration changes through configd. This results in an authenticated Cross‑Site Request Forgery vulnerability allowing unauthorized system state changes. This vulnerability is fixed in 26.1.4.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-30868?
CVE-2026-30868 has a severity rating that indicates a significant risk due to the potential for unauthorized changes via CSRF attacks.
How do I fix CVE-2026-30868?
Fix CVE-2026-30868 by updating OPNsense core to version 26.1.4 or newer to ensure CSRF protection is implemented.
Which versions of OPNsense core are affected by CVE-2026-30868?
CVE-2026-30868 affects all versions of OPNsense core prior to 26.1.4.
What kind of attack does CVE-2026-30868 facilitate?
CVE-2026-30868 facilitates Cross-Site Request Forgery (CSRF) attacks that can allow unauthorized actions to be performed by an attacker.
Are there any mitigation strategies for CVE-2026-30868?
While upgrading to a secure version is the best solution, employing web application firewalls or monitoring could help mitigate risks until the patch is applied.