CVE-2026-34578 Details
Description
OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.6, OPNsense's LDAP authentication connector passes the login username directly into an LDAP search filter without calling ldap_escape(). An unauthenticated attacker can inject LDAP filter metacharacters into the username field of the WebGUI login page to enumerate valid LDAP usernames in the configured directory. When the LDAP server configuration includes an Extended Query to restrict login to members of a specific group, the same injection can be used to bypass that group membership restriction and authenticate as any LDAP user whose password is known, regardless of group membership. This vulnerability is fixed in 26.1.6.
A vulnerability exists in OPNsense's LDAP authentication connector, affecting versions through 26.1.5. The issue arises because the connector passes the login username directly into an LDAP search filter without proper sanitization. This flaw allows an unauthenticated attacker to inject LDAP filter metacharacters into the username field on the WebGUI login page. As a result, attackers can enumerate valid LDAP usernames or, if the LDAP server configuration includes group membership restrictions, bypass those restrictions to authenticate as any LDAP user whose password is known.
Users should update to OPNsense version 26.1.6 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/opnsense/core/security/advisories/GHSA-jpm7-f59c-mp54 | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/opnsense/core/commit/016f66cb4620cd48183fa97843f343bb71813c6e | [email protected] | Patch |
| https://github.com/opnsense/core/security/advisories/GHSA-jpm7-f59c-mp54 | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-90 | Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| opnsense opnsense | < 26.1.6 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 14, 2026 | Initial Analysis | [email protected] |
| Apr 9, 2026 | CVE Modified | CISA-ADP |
| Apr 9, 2026 | New CVE Received | [email protected] |