CVE-2026-58395
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the safe-delete path reached through ApiMutableModelControllerBase::delBase() interpolates an unvalidated safe-delete token from the request URL into an XPath expression over config.xml before confirming that the token is a valid identifier. A user holding any one affected module privilege can send a crafted token to one of 21 affected delete endpoints covering Traffic Shaper, DHCP relay, Dnsmasq, Firewall Category, or Kea DHCP, causing the XPath to match configuration data across modules.
Read full descriptionShow less
The resulting error response exposes configuration item names, descriptions, reference paths, and UUIDs and provides an XPath substring-presence oracle, including for modules the user cannot otherwise access. The request does not modify configuration or perform a deletion. This issue is fixed in version 26.1.11.
CVSS
- Base score
- 4.3
- Version
- 3.1
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days
- 0.36 %
- Percentile among all scored CVEs
- 28
- Score date
- 10/20/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
ATT&CK techniques
How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.
- Exploitation
T1210Exploitation of Remote Serviceslateral movement85 % - Primary impact
T1005Data from Local Systemcollection70 %
Vector PR:L sin UI y red (AV:N) indica T1210; la descripción dice que la respuesta de error expone nombres, descripciones, rutas y UUID de config.xml, es decir, lectura de datos locales.
Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.
ATT&CK mitigations that cover these techniques
Affected technologies (1)
⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.
CWEs
- CWE-643
References
Show 5 references
- https://github.com/opnsense/core/commit/631e14721b311badc1d3c0d29321e4d42585156b
- https://github.com/opnsense/core/commit/d7054cef69f72588feac1091254960835be19dfe
- https://github.com/opnsense/core/security/advisories/GHSA-98h6-479q-9q3w
- https://hackerask.com/posts/opnsense
- https://github.com/opnsense/core/security/advisories/GHSA-98h6-479q-9q3w
Raw JSON (NVD)
Show
{
"id": "CVE-2026-58395",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-58395",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2026-10-15T18:37:26.648179Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "security-advisories@github.com",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 4.3,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "LOW",
"confidentialityImpact": "LOW"
},
"impactScore": 1.4,
"exploitabilityScore": 2.8
}
]
},
"affected": [
{
"source": "security-advisories@github.com",
"affectedData": [
{
"vendor": "opnsense",
"product": "core",
"versions": [
{
"status": "affected",
"version": "< 26.1.11"
}
]
}
]
}
],
"published": "2026-10-15T16:18:18.583",
"references": [
{
"url": "https://github.com/opnsense/core/commit/631e14721b311badc1d3c0d29321e4d42585156b",
"source": "security-advisories@github.com"
},
{
"url": "https://github.com/opnsense/core/commit/d7054cef69f72588feac1091254960835be19dfe",
"source": "security-advisories@github.com"
},
{
"url": "https://github.com/opnsense/core/security/advisories/GHSA-98h6-479q-9q3w",
"source": "security-advisories@github.com"
},
{
"url": "https://hackerask.com/posts/opnsense",
"source": "security-advisories@github.com"
},
{
"url": "https://github.com/opnsense/core/security/advisories/GHSA-98h6-479q-9q3w",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
}
],
"vulnStatus": "Deferred",
"weaknesses": [
{
"type": "Secondary",
"source": "security-advisories@github.com",
"description": [
{
"lang": "en",
"value": "CWE-643"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the safe-delete path reached through ApiMutableModelControllerBase::delBase() interpolates an unvalidated safe-delete token from the request URL into an XPath expression over config.xml before confirming that the token is a valid identifier. A user holding any one affected module privilege can send a crafted token to one of 21 affected delete endpoints covering Traffic Shaper, DHCP relay, Dnsmasq, Firewall Category, or Kea DHCP, causing the XPath to match configuration data across modules. The resulting error response exposes configuration item names, descriptions, reference paths, and UUIDs and provides an XPath substring-presence oracle, including for modules the user cannot otherwise access. The request does not modify configuration or perform a deletion. This issue is fixed in version 26.1.11."
}
],
"lastModified": "2026-10-15T21:08:49.703",
"sourceIdentifier": "security-advisories@github.com"
}