CVE-2026-53582 Details

A stored XPath injection vulnerability has been identified in the OPNsense Trust module, affecting versions prior to 26.1.10. The issue arises because the Trust module improperly sanitizes user-controlled certificate authority and certificate reference ID values, allowing for the injection of XPath expressions. This vulnerability can be exploited by users with CA Manager or Certificate Manager privileges to leak sensitive information from the config.xml file, such as password hashes, API credentials, private keys, VPN materials, and high-availability credentials. The extracted data could be used for privilege escalation and compromising other security domains.

Users are advised to update OPNsense to version 26.1.10 or 26.4.1, both of which include the necessary fix. Alternatively, the vulnerability can be manually addressed by adding a regular expression validation to the 'refid' field in the CA and Certificate XML files.