CVE-2026-53582: CWE-91: XML Injection (aka Blind XPath Injection) in opnsense core

OPNsense core versions before 26.1.10 contain an XML Injection (Blind XPath Injection) vulnerability in the Trust module. The vulnerability arises because attacker-controlled certificate authority and certificate refid values are interpolated into XPath expressions without proper sanitization in specific PHP files. A user with CA Manager or Certificate Manager privileges can exploit this by submitting crafted refid values and repeatedly retrieving objects to perform a boolean refcount oracle attack. This allows the attacker to extract sensitive data from config.xml, including password hashes, API credentials, certificate private keys, VPN key material, and high-availability credentials. This exposure can lead to privilege escalation and compromise of other security domains. The vulnerability is addressed in OPNsense core version 26.1.10.

An attacker with CA Manager or Certificate Manager privileges can exploit this vulnerability to extract sensitive configuration data from the system, including password hashes, API credentials, private keys, and VPN key material. This can lead to privilege escalation and compromise of other security domains within the OPNsense platform. The vulnerability has a CVSS score of 7.1 (High severity), indicating a significant impact on confidentiality with limited attack complexity but requiring some privileges.

Upgrade OPNsense core to version 26.1.10 or later, where this vulnerability is fixed. No other specific mitigations are indicated. Since this is a privilege-level vulnerability, restricting CA Manager and Certificate Manager privileges to trusted users is advisable until the patch is applied.