CVE-2026-34578: OPNsense has an LDAP Injection via Unsanitized Username in Authentication
OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.6, OPNsense's LDAP authentication connector passes the login username directly into an LDAP search filter without calling ldapescape(). An unauthenticated attacker can inject LDAP filter metacharacters into the username field of the WebGUI login page to enumerate valid LDAP usernames in the configured directory. When the LDAP server configuration includes an Extended Query to restrict login to members of a specific group, the same injection can be used to bypass that group membership restriction and authenticate as any LDAP user whose password is known, regardless of group membership. This vulnerability is fixed in 26.1.6.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34578?
CVE-2026-34578 has a moderate severity rating due to the potential for LDAP injection attacks.
How do I fix CVE-2026-34578?
To fix CVE-2026-34578, upgrade OPNsense to version 26.1.6 or later to ensure proper input sanitization.
What systems are affected by CVE-2026-34578?
CVE-2026-34578 affects OPNsense versions prior to 26.1.6.
What type of vulnerability is CVE-2026-34578?
CVE-2026-34578 is classified as an LDAP injection vulnerability.
Can CVE-2026-34578 lead to data compromise?
Yes, CVE-2026-34578 can potentially lead to unauthorized access and data compromise due to injection flaws.