CVE-2026-71490
HIGH 7.1OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11, OPNsense\Core\ACL::hasPrivilege() appends a directly assigned comma-separated <priv> value as one string and then uses an exact comparison when checking user-config-readonly. A user directly assigned both a component write privilege and user-config-readonly can therefore be treated as lacking the read-only restriction, and MVC APIs protected by throwReadOnly() can persist configuration changes for that component. Group privileges are not affected by the same parser flaw because the group path already splits comma-separated values. This issue is fixed in version 26.1.11.
Severe if exploited (CVSS 7.1), but no known exploitation and low modeled probability. Patch on a normal cadence.
Exploitation likelihood
0.4%chance of exploitation in 30 days · 32nd percentile
Impact if exploited
7.1CVSS 3.1 · HIGH
- ConfidentialityNone
- IntegrityHigh
- AvailabilityLow
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ⚠Privileges: Requires a low-privilege account
- ✓User interaction: No user interaction needed
- ✓Complexity: No special conditions — reliably repeatable
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Data snapshot:
Weakness (CWE)
- CWE-863: : Incorrect Authorization
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
References and research data (JSON)
All CVSS metrics
- HIGH 7.1 v3.1 · CNA Primary
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L - HIGH 7.1 v3.1 · NVD Secondary
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
References
Exploit-tagged references (not proof of a PoC)
- https://github.com/opnsense/core/security/advisories/GHSA-p9pr-782r-w2xw CVE record · GitHub_M · Updated 2026-10-15T15:24:43.580Z
CVE record · CISA-ADP · Updated 2026-10-15T15:45:03.645Z
NVD · CVE-2026-71490 · Updated 2026-10-15T21:08:49.703
Advisories
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-102140 EUVD · EUVD-2026-102140
Technical & other
- https://github.com/opnsense/core/commit/578e025111161ffd03fd3fd0ccdac203be546505 CVE record · GitHub_M · Updated 2026-10-15T15:24:43.580Z
NVD · CVE-2026-71490 · Updated 2026-10-15T21:08:49.703 - https://github.com/opnsense/core/commit/e15a884973746319e79bd2cd421e8a015cc3ddb9 CVE record · GitHub_M · Updated 2026-10-15T15:24:43.580Z
NVD · CVE-2026-71490 · Updated 2026-10-15T21:08:49.703 - https://github.com/opnsense/core/commit/f674f4ff294a3f7c4cd0591563f6df47bea50034 CVE record · GitHub_M · Updated 2026-10-15T15:24:43.580Z
NVD · CVE-2026-71490 · Updated 2026-10-15T21:08:49.703