Is CVE-2026-57154 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-57154 being exploited in the wild.

How severe is CVE-2026-57154?

High severity, with a CVSS score of 8.1, published 3 November 2026.

Which products and versions are affected?

OPNsense before 26.1.11 and before 26.4.1p1.

Is there a fix for CVE-2026-57154?

Yes: fixed in 26.1.11 and 26.4.1p1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-57154 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-57154?

Check whether you run OPNsense at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57154: OPNsense configuration line injection via GUI and API fields

CVE-2026-57154 · Severity: high · CVSS 8.1 · Published 2026-11-03

OPNsense is a FreeBSD-based firewall and routing platform that manages network security and DHCP services through a web interface and API. Authenticated users with delegated access to configuration settings can inject carriage return and line feed characters into text fields, allowing them to inject arbitrary directives into critical system configuration files like dnsmasq.conf, monitrc, and others. This can lead to service malfunction, denial of service, privilege escalation, or in some cases command execution with root privileges.

Technologies: OPNsense. Vendors: OPNsense.

Quick answers

Is CVE-2026-57154 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-57154 being exploited in the wild.
How severe is CVE-2026-57154?: High severity, with a CVSS score of 8.1, published 3 November 2026.
Which products and versions are affected?: OPNsense before 26.1.11 and before 26.4.1p1.
Is there a fix for CVE-2026-57154?: Yes: fixed in 26.1.11 and 26.4.1p1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57154 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-57154?: Check whether you run OPNsense at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 26.1.11 and 26.4.1p1

Technical details

The vulnerability is a configuration line injection flaw affecting multiple services (Dnsmasq, OpenVPN, DHCPv6, Unbound, IPsec, NTP, PPP/MPD, Monit, firewall, sudo, WebGUI, and System General). Authenticated and delegated Web UI or API users can submit CR/LF characters in single-line text fields, which are rendered unsanitized into privileged service configuration files. Exploitation requires authentication with delegated access but can bypass RBAC boundaries, alter service behavior beyond intended settings, create unauthorized service-side files, or achieve root command execution through specific paths like Monit mail configuration.

Affected products

OPNsense OPNsense before 26.1.11 and before 26.4.1p1

Timeline

2026-11-03: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.