CVE-2026-63442: OPNsense: Log Forgery via Login Username CRLF in WebGUI Authentication → Pf Table IP Blocking
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the unauthenticated WebGUI login usernamefld accepts carriage-return and line-feed characters that survive LOGAUTH processing through syslog-ng-lockout.conf into the syslog-ng program destination feeding lockouthandler. The consumer's readline() processing treats an injected fragment as a separate authentication event and selects the first syntactically valid IP address from the forged line. An attacker with network access to the login page can forge failure events for another IP, causing that IP to be added to the sshlockout PF table and its active states to be killed, or forge accepted events that reset an attacker's own brute-force counter. This can block administrative, DNS, gateway, or monitoring addresses and can bypass password-guessing lockout without authentication. This issue is fixed in version 26.1.11.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OPNsenseto a version that resolves this vulnerability.Fixed in 26.1.11
Event History
Frequently Asked Questions
Which systems are exposed to exploitation?
OPNsense installations running a version earlier than 26.1.11 are affected if an attacker can reach the unauthenticated WebGUI login page over the network.
Does exploitation require valid credentials or user interaction?
No. The issue can be exploited without authentication or user interaction; the attacker submits a crafted login username containing carriage-return and line-feed characters.
What are the practical impacts of exploitation?
An attacker can forge authentication failures for another IP address, causing it to be added to the sshlockout PF table and its active states to be killed. This can disrupt administrative, DNS, gateway, or monitoring addresses; forged accepted events can also reset the attacker’s own brute-force counter.
What version fixes the issue?
Upgrade OPNsense to version 26.1.11 or later. The provided data does not specify a workaround for systems that cannot be upgraded immediately.