CVE-2026-53582

HighCVSS 7.1/10Last modified Oct 16, 2026

Description

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.10, the Trust module stores attacker-controlled certificate authority and certificate refid values and interpolates them into XPath expressions in src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CAsField.php and src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CertificatesField.php. A user with CA Manager or Certificate Manager privileges can submit a crafted refid and repeatedly retrieve the object to obtain a boolean refcount oracle, allowing values in config.xml to be recovered character by character. Exposed values can include password hashes, API credentials, certificate private keys, VPN key material, and high-availability credentials, enabling privilege escalation and compromise of other security domains. This issue is fixed in version 26.1.10.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:L

Weakness enumeration

CWE-91 CWE-643

Affected software

No affected versions have been published.

Timeline

Published: Oct 15, 2026
Last modified: Oct 16, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-535836.5libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functi CVE-2026-535844.3libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functi CVE-2026-535855.3libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functi CVE-2026-535866.5libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functi CVE-2026-535877.5libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functi CVE-2026-535918.6FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.223, an unauthenticated attacker can CVE-2026-535924.6FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. A Prototype Pollution condition in the `getQueryParam` fu CVE-2026-535938.8FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the denylist that neutralizes d CVE-2026-535944.9FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. FreeScout's `Manage -> Logs -> App Logs` feature uses the CVE-2026-535959.4FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the public endpoint `POST /user CVE-2026-535965.3FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the FreeScout helpdesk applicat CVE-2026-535978.7Prompty is a markdown file format (.prompty) for LLM prompts. From 2.0.0-alpha.1 until 2.0.0-beta.3, the @prompty/core TypeScript loader in