# CVE-2026-53582: OPNsense Trust module XPath injection in certificate refid

Source: https://junglewise.ai/threats/cve-2026-53582-opnsense-is-a-freebsd-based-firewall-and-routing-platform-prior  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-15. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-53582 · Severity: high · CVSS 7.1 · Published 2026-10-15

OPNsense is a FreeBSD-based firewall that protects corporate networks and infrastructure. The Trust module, which manages certificate authorities and certificates, contains an injection vulnerability that allows users with CA or Certificate Manager privileges to extract sensitive data stored in the firewall's configuration by exploiting how certificate references are processed. An attacker could recover passwords, API credentials, encryption keys, and other secrets character by character, leading to privilege escalation and compromise of other security systems.

Technologies: [OPNsense](https://junglewise.ai/threats/technologies/opnsense). Vendors: [OPNsense](https://junglewise.ai/threats/vendors/opnsense).

## Quick answers

**Is CVE-2026-53582 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-53582 being exploited in the wild.

**How severe is CVE-2026-53582?** High severity, with a CVSS score of 7.1, published 15 October 2026.

**Which products and versions are affected?** OPNsense prior to 26.1.10.

**Is there a fix for CVE-2026-53582?** Yes: fixed in 26.1.10. Until then: Restrict the assignment of CA Manager and Certificate Manager roles to only trusted administrators until the firewall can be upgraded to version 26.1.10. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-53582 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-53582?** Check whether you run OPNsense at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 26.1.10

Restrict the assignment of CA Manager and Certificate Manager roles to only trusted administrators until the firewall can be upgraded to version 26.1.10.

## Technical details

The Trust module in OPNsense interpolates attacker-controlled certificate authority and certificate refid values directly into XPath expressions without proper validation. A privileged user (CA Manager or Certificate Manager) can craft a malicious refid and repeatedly retrieve the object to obtain a boolean refcount oracle, allowing configuration values to be exfiltrated one character at a time. The vulnerability affects src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CAsField.php and CertificatesField.php and is fixed by restricting refid values to strict alphanumeric-only patterns.

## Affected products

- OPNsense OPNsense prior to 26.1.10

## Timeline

- 2026-10-15: disclosed
- 2026-10-15: patched: Version 26.1.10 released with fix enforcing strict alphanumeric-only regex for certificate refid

## References

- [https://github.com/opnsense/core/commit/e2cd067343511252fb0d391a17d82d3ecceece45](https://github.com/opnsense/core/commit/e2cd067343511252fb0d391a17d82d3ecceece45)
- [https://github.com/opnsense/core/commit/fc2f0d745c17855d2027b192fd4e3fa913e26859](https://github.com/opnsense/core/commit/fc2f0d745c17855d2027b192fd4e3fa913e26859)

## Related threats

- [OPNsense configuration line injection via GUI and API fields](https://junglewise.ai/threats/cve-2026-57154-opnsense-is-a-freebsd-based-firewall-and-routing-platform-prior)
- [OPNsense cross-site scripting in web interface](https://junglewise.ai/threats/cve-2026-115425-multiple-cross-site-scripting-xss-vulnerabilities-affect)
- [OPNsense newline injection in WebGUI login lockout bypass](https://junglewise.ai/threats/cve-2026-63442-opnsense-is-a-freebsd-based-firewall-and-routing-platform-prior)
- [OPNsense stored cross-site scripting in firewall rule and NAT tooltips](https://junglewise.ai/threats/cve-2026-58391-opnsense-is-a-freebsd-based-firewall-and-routing-platform-prior)
- [OPNsense stored XSS in OpenVPN connection-status widget](https://junglewise.ai/threats/cve-2026-58390-opnsense-is-a-freebsd-based-firewall-and-routing-platform-prior)