CVE-2026-57154

{
  "etk_id": "ETK-2026-3396",
  "cve_id": "CVE-2026-57154",
  "display_id": "CVE-2026-57154",
  "ghsa_id": null,
  "euvd_id": "EUVD-2026-116116",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Configuration line injection in OPNsense core",
  "summary": "OPNsense core releases before 26.1.11 and 26.4.1p1 mishandle line-break characters in multiple delegated configuration fields. An authenticated user with access to an affected Web UI or API setting may add unintended directives to generated service configuration, potentially changing service behavior, bypassing delegated permission boundaries, or causing denial of service.",
  "mitigation": "Upgrade OPNsense core to 26.1.11 or 26.4.1p1. Until upgraded, restrict delegated Web UI and API access to affected configuration settings and review privileged service configuration changes.",
  "vendor": "opnsense",
  "product": "core",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<= 26.1.10",
        "<= 26.4.1"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "26.1.11",
        "26.4.1p1"
      ],
      "package_name": "opnsense/core - Dnsmasq MVC configuration",
      "purl": null
    }
  ],
  "cwes": [
    74
  ],
  "cvss_score": 8.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 21.474898233333334,
  "t0_at": "2026-11-03T18:10:28.787000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-03T18:10:28.787000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-03T18:10:28.787000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-57154"
    }
  }
}